id: PYSEC-2017-19
details: An exploitable vulnerability exists in the YAML parsing functionality in
  the parse_yaml_query method in parser.py in MLAlchemy before 0.2.2. When processing
  YAML-Based queries for data, a YAML parser can execute arbitrary Python commands
  resulting in command execution because load is used where safe_load should have
  been used. An attacker can insert Python into loaded YAML to trigger this vulnerability.
affected:
- package:
    name: mlalchemy
    ecosystem: PyPI
    purl: pkg:pypi/mlalchemy
  ranges:
  - type: GIT
    repo: https://github.com/thanethomson/MLAlchemy
    events:
    - introduced: '0'
    - fixed: bc795757febdcce430d89f9d08f75c32d6989d3c
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: 0.2.2
  versions:
  - 0.1.0
  - 0.1.1
  - 0.1.2
  - 0.1.3
  - 0.2.0
  - 0.2.1
references:
- type: REPORT
  url: https://github.com/thanethomson/MLAlchemy/issues/1
- type: ARTICLE
  url: https://joel-malwarebenchmark.github.io/blog/2017/11/08/cve-2017-16615-critical-restful-web-applications-vulnerability/
- type: FIX
  url: https://github.com/thanethomson/MLAlchemy/commit/bc795757febdcce430d89f9d08f75c32d6989d3c
- type: ADVISORY
  url: https://github.com/advisories/GHSA-xpm8-98mx-h4c5
aliases:
- CVE-2017-16615
- GHSA-xpm8-98mx-h4c5
modified: '2021-07-05T00:01:22.762966Z'
published: '2017-11-08T03:29:00Z'