Description
Sqla_yaml_fixtures 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in sqla_yaml_fixtures.load.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | sqla-yaml-fixtures | <= 0.9.1 | — | GHSA-2x54-j4m3-r6wx |
| PyPI | sqla-yaml-fixtures | < 1.0.0 | 1.0.0 | PYSEC-2019-122 |