CVE-2021-38305: Yamale Remote Code Execution Vulnerability
Summary
CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. Affects yamale versions < 3.0.8. Fixed in 3.0.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Yamale is a Python package available on PyPI that provides a schema-based validation tool for YAML files. It allows users to define schemas to validate the structure and content of YAML files. Yamale versions prior to 3.0.8 are affected by a remote code execution vulnerability. This vulnerability arises from the use of the eval function in the schema parser, which can be exploited by an attacker to execute arbitrary code on the system. By crafting a malicious schema file, an attacker can invoke Yamale and run arbitrary commands on the underlying system.
Vulnerability Detail
The vulnerability (CVE-2021-38305) in Yamale allows remote attackers to execute arbitrary code by exploiting the schema parser's use of eval. The parser limits the builtins passed to eval to protect against malicious expressions. However, a well-constructed string within the schema rules can still execute system commands. This means that an attacker can run arbitrary code on the system by leveraging this vulnerability.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "yamale==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.8
This is the first release that contains the fix.
pip install --upgrade "yamale==3.0.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of Yamale as soon as possible.
Conclusion
The Yamale package is vulnerable to a remote code execution vulnerability that can be exploited by crafting a malicious schema file. To mitigate this vulnerability, users should upgrade to Yamale version 3.0.8 or later. There is no known workaround for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yamale →
FAQ
Yamale is a Python package that provides a schema-based validation tool for YAML files. It allows users to define schemas to validate the structure and content of YAML files.
This vulnerability allows remote attackers to execute arbitrary code on systems running vulnerable versions of Yamale. By crafting a malicious schema file, an attacker can run arbitrary commands on the underlying system.
To fix this vulnerability, users should upgrade to Yamale version 3.0.8 or later. This version includes a fix for the remote code execution vulnerability. Users can update their Yamale installation by running the command: pip install --upgrade yamale
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of Yamale as soon as possible.
For more information about this vulnerability, you can refer to the CVE-2021-38305 entry or the Yamale advisory on the PyPI advisory database.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
