Code injection in ymlref · CVE-2018-20133 · GitHub Advisory Database · GitHub

Code injection in ymlref

Critical severity GitHub Reviewed Published Dec 19, 2018 to the GitHub Advisory Database • Updated Aug 16, 2023

Package

ymlref (pip)

Affected versions

<= 0.1.1

Patched versions

None

Description

ymlref is a library that allows to load Yaml documents and resolve JSON-pointer references inside them. ymlref versions up to 0.1.1 allow code injection.

References

Published to the GitHub Advisory Database Dec 19, 2018

Reviewed Jun 16, 2020

Last updated Aug 16, 2023

Severity

Critical

9.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H