CVE-2021-24040 in the critical feed json
Deserialization of Untrusted Data in parlai
published 5y ago modified 4mo ago also CVE-2021-39207 , GHSA-m87f-9fvv-2mgg , GHSA-mwgj-7x7j-6966 , PYSEC-2021-330 , PYSEC-2021-334 , EUVD-2021-0165
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 17.4%
- EPSS 17.4% chance of exploitation in 30 days, percentile 97%
- public exploits
- 1
- Exploit-DB
Summary
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.
Patch / fix
- pypi parlai 1.1.0
- Facebook ParlAI 1.1.0
- github.com/facebookresearch/ParlAI@4374fa2 commit
- github.com/facebookresearch/ParlAI@507d066 commit
- github.com/facebookresearch/ParlAI#3402 pull request
- github.com/facebookresearch/ParlAI#3429 pull request
- github.com/facebookresearch/ParlAI/releases/tag/v1.1.0 release
- github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv… advisory
Is CVE-2021-24040 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerTimeline
- Published
- First public exploit (EDB-50289)
Exploit prediction
17.35% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-50289 Facebook ParlAI 1.0.0 - Deserialization of Untrusted Data in parlai local, 2021-09-13
- packetstormsecurity.com http://packetstormsecurity.com/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 8.4 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | parlai | <1.1.0 |
1.1.0 |
Affected products
- Facebook ParlAI
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg
web, patch, third-party-advisory, advisory
-
github.com
/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879
web, patch
-
github.com
/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725
web, patch
-
github.com
/facebookresearch/ParlAI/pull/3402
web
-
github.com
/facebookresearch/ParlAI/pull/3429
web
-
packetstormsecurity.com
/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.html
web, exploit, third-party-advisory, vdb-entry
-
github.com
/facebookresearch/ParlAI/releases/tag/v1.1.0
web, release-notes, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-39207
advisory
-
github.com
/advisories/GHSA-mwgj-7x7j-6966
advisory
-
github.com
/facebookresearch/ParlAI
package
-
github.com
/pypa/advisory-database/tree/main/vulns/parlai/PYSEC-2021-330.yaml
web
-
github.com
/pypa/advisory-database/tree/main/vulns/parlai/PYSEC-2021-334.yaml
web
-
nvd.nist.gov
/vuln/detail/CVE-2021-24040
advisory
Sources
- CVE List CVE-2021-24040
- GitHub Advisory GHSA-m87f-9fvv-2mgg
- GitHub Advisory GHSA-mwgj-7x7j-6966
- NVD CVE-2021-24040
- OSV PYSEC-2021-330
- OSV PYSEC-2021-334
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.