CVE-2021-24040

Published: Sep 10, 2021Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.

Affected (1)

Products: Facebook: Parlai

Facebook

1 product

Parlai

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Facebook Parlai	Before 1.1.0

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (6)

http://packetstormsecurity.com/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.html

Source: cve-assign@fb.com

ExploitThird Party AdvisoryVDB Entry

https://github.com/facebookresearch/ParlAI/releases/tag/v1.1.0

Source: cve-assign@fb.com

Release NotesThird Party Advisory

https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg

Source: cve-assign@fb.com

PatchThird Party Advisory

http://packetstormsecurity.com/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://github.com/facebookresearch/ParlAI/releases/tag/v1.1.0

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.