An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file
method in io_utils.py
in djangomakeapp 0.1.3. A YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability.
{ "nvd_published_at": null, "cwe_ids": [ "CWE-94" ], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2020-06-16T21:29:17Z" }