CVE-2011-4104 json
Django Tastypie Improper Deserialization of YAML Data
published 2014-10-27 12 y ago modified 2026-06-16 4 mo ago also GHSA-qgvw-qc2q-gv5q , PYSEC-2014-25 , EUVD-2014-0006
- cvss
- 9.8
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.5%
- EPSS 2.5% chance of exploitation in 30 days, percentile 84%
- public exploits
- 0
- none known
Summary
The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
Patch / fix
- pypi django-tastypie 0.9.10
- django-tastypie Debian 14, Debian 13, Debian 12 0.9.10-1
debian advisories DEBIAN-CVE-2011-4104
Exploit prediction
2.48% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | django-tastypie | <0.9.10 |
0.9.10 |
Classification
References
-
github.com
/toastdriven/django-tastypie/commit/e8af315211b07c8f48f32a063233cc3f76dd5bc2
web, patch
-
openwall.com
/lists/oss-security/2011/11/02/1
mailing-list, web, patch
-
djangoproject.com
/weblog/2011/nov/01/piston-and-tastypie-security-releases/
vendor-advisory, article
- groups.google.com /forum/#%21topic/django-tastypie/i2aNGDHTUBI
-
openwall.com
/lists/oss-security/2011/11/02/7
mailing-list, web
-
nvd.nist.gov
/vuln/detail/CVE-2011-4104
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/django-tastypie/PYSEC-2014-25.yaml
web
-
github.com
/toastdriven/django-tastypie
package
-
groups.google.com
/forum/#!topic/django-tastypie/i2aNGDHTUBI
web
-
djangoproject.com
/weblog/2011/nov/01/piston-and-tastypie-security-releases
web
-
github.com
/advisories/GHSA-qgvw-qc2q-gv5q
advisory
Sources
- CVE List CVE-2011-4104
- GitHub Advisory GHSA-qgvw-qc2q-gv5q
- NVD CVE-2011-4104
- OSV PYSEC-2014-25
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.