qlibGHSA-hjr4-fhgp-23g9

qlib Deserialization of Untrusted Data vulnerability

Medium6.6CVE-2021-23338 · Published May 24, 2022 · updated Oct 14, 2024

This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function.

GitHub advisory

Affected versions

Package	Affected	Fixed in
pyqlib PyPI	< 0.7.0	0.7.0

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-502, CWE-94
Also known as: CVE-2021-23338, PYSEC-2021-86, SNYK-PYTHON-QLIB-1054635

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.