CVE-2021-39207

    Dashboard / Vulnerabilities / CVE-2021-39207

    CVE-2021-39207

    Published: 10 Sept 2021Last Modified: 9 Jul 2026

    Summary:

    Details: parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding unsafe loader users should update to version above v1.1.0. If upgrading is not possible then users can change the Loader used to SafeLoader as a workaround. See commit 507d066ef432ea27d3e201da08009872a2f37725 for details.

    References: https://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879, https://github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725, https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -7092d77796ae23a4b606b8e61aee7c817747add7

    Affected versions

    v1.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-39207 | CVE-DB