CVE-2011-4104
HighSummary
The from_yaml method in serializers.py in Django Tastypie before version 0.9.10 does not properly deserialize YAML data, allowing remote attackers to execute arbitrary Python code.
Risk Assessment
Attackers can exploit this vulnerability to execute code remotely, potentially leading to serious security breaches in the application.
Recommendation
It is recommended to upgrade Django Tastypie to version 0.9.10 or later to mitigate this vulnerability.
Other vulnerabilities in Django Tastypie
See all- CVE-2026-16208Medium
In django-tastypie up to version 0.15.1, the CacheThrottle/CacheDBThrottle function in tastypie/throttle.py has a race condition vulnerability. The attack can be remote but is difficult to exploit. The project was informed but has not responded.
- CVE-2026-16207Low
A vulnerability was found in django-tastypie up to version 0.15.1 in the ApiKeyAuthentication function within tastypie/authentication.py. The issue involves using the GET method with sensitive query strings, potentially leaking API keys. The attack is remote but has high complexity and is considered difficult to exploit.
Original NVD description (English source)
The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.