Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJ4NTQtajRtMy1yNnd4

sqla-yaml-fixtures is vulnerable to Code Injection

Sqla_yaml_fixtures versions up to 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in sqla_yaml_fixtures.load.

Permalink: https://github.com/advisories/GHSA-2x54-j4m3-r6wx
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJ4NTQtajRtMy1yNnd4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 6 years ago
Updated: about 1 month ago

CVSS Score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-2x54-j4m3-r6wx, CVE-2019-3575
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-3575
• https://github.com/schettino72/sqla_yaml_fixtures/issues/20
• https://github.com/advisories/GHSA-2x54-j4m3-r6wx
• https://github.com/pypa/advisory-database/tree/main/vulns/sqla-yaml-fixtures/PYSEC-2019-122.yaml

Repository: https://github.com/schettino72/sqla_yaml_fixtures
Blast Radius: 0.0

Affected Packages