CVE-2021-24040: Deserialization of Untrusted Data

September 10, 2021 (updated September 24, 2021)

Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks.

References

packetstormsecurity.com/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.html
nvd.nist.gov/vuln/detail/CVE-2021-24040

Detect and mitigate CVE-2021-24040 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →