In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").
References:- https://nvd.nist.gov/vuln/detail/CVE-2018-17175
- https://github.com/marshmallow-code/marshmallow/issues/772
- https://github.com/marshmallow-code/marshmallow/pull/777
- https://github.com/marshmallow-code/marshmallow/pull/782
- https://github.com/pypa/advisory-database/tree/main/vulns/marshmallow/PYSEC-2018-67.yaml
- https://github.com/advisories/GHSA-9q2p-fj49-vpxj