CVE-2017-16618
CriticalSummary
An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before version 2.0.0a12. The use of load instead of safe_load allows for arbitrary Python command execution by injecting code into loaded YAML.
Risk Assessment
An attacker can exploit this vulnerability to execute unauthorized commands on the system, posing a significant threat to the application's and data's security.
Recommendation
It is recommended to update OwlMixin to version 2.0.0a12 or later to mitigate this vulnerability and to use safe_load instead of load when loading YAML.
Original NVD description (English source)
An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before 2.0.0a12. A "Load YAML" string or file (aka load_yaml or load_yamlf) can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used. An attacker can insert Python into loaded YAML to trigger this vulnerability.