Skip to content
OpenAdvisories
High · 7.8 Public exploit CVE-2021-43811 EUVD-2021-0247GHSA-ggmr-44cv-24pmPYSEC-2021-848

Code injection via unsafe YAML loading

Published Dec 8, 2021 · Updated Aug 4, 2024 · Assigned by GitHub_M

Vendor: awslabs Product: sockeye Package: sockeye Ecosystem: PyPI

Description

Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An attacker can add malicious code to the config file of a trained model and attempt to convince users to download and run it. If users run the model, the embedded code will run locally. The issue is fixed in version 2.3.24.

Affected products

VendorProductAffectedFixed
awslabs sockeye < 2.3.24 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • s-index/CVE-2021-43811 ★ 2 · Aug 21, 2022

    awslabs/sockeye Code injection via unsafe YAML loading CVE-2021-43811

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI sockeye < 2.3.24 2.3.24 GHSA-ggmr-44cv-24pm

References