CVE-2017-16764

Critical

Published: 10/11/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file method in django_make_app 0.1.3, allowing arbitrary Python command execution. An attacker can inject Python code into loaded YAML to trigger this vulnerability.

Risk Assessment

This vulnerability poses a serious security risk, enabling attackers to execute remote code on the server, potentially leading to system compromise.

Recommendation

It is recommended to upgrade to a newer version of django_make_app that addresses this vulnerability. Additionally, avoid loading untrusted YAML files.

Original NVD description (English source)

An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file method in io_utils.py in django_make_app 0.1.3. A YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability.