Description
An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file method in io_utils.py in django_make_app 0.1.3. A YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django-make-app | <= 0.1.3 | — | GHSA-9pv8-q5rx-c8gq |
| PyPI | django-make-app | >= 0.1.0.1 | — | PYSEC-2017-79 |