CVE-2018-14572: OS Command Injection
(updated )
In conference-scheduler-cli
, a pickle.load
call on imported data allows remote attackers to execute arbitrary code via a crafted .pickle
file, as demonstrated by Python code that contains an os.system
call.
References
Detect and mitigate CVE-2018-14572 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →