CVE-2017-16615
CriticalSummary
An exploitable vulnerability exists in the YAML parsing functionality in MLAlchemy before version 0.2.2, allowing arbitrary Python command execution due to the use of load instead of safe_load when processing YAML-based queries.
Risk Assessment
An attacker can inject Python code into loaded YAML, leading to unauthorized command execution in the system. This poses a significant security risk to the application and its data.
Recommendation
It is recommended to update MLAlchemy to version 0.2.2 or later to mitigate this vulnerability. Additionally, avoid using the load function in the context of processing YAML data.
Original NVD description (English source)
An exploitable vulnerability exists in the YAML parsing functionality in the parse_yaml_query method in parser.py in MLAlchemy before 0.2.2. When processing YAML-Based queries for data, a YAML parser can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used. An attacker can insert Python into loaded YAML to trigger this vulnerability.