CVE-2021-39207 json
Deserialization of Untrusted Data in parlai
published 2021-09-10 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-34767
- cvss
- 8.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.8%
- EPSS 1.8% chance of exploitation in 30 days, percentile 78%
- public exploits
- 0
- none known
Summary
parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding unsafe loader users should update to version above v1.1.0. If upgrading is not possible then users can change the Loader used to SafeLoader as a workaround. See commit 507d066ef432ea27d3e201da08009872a2f37725 for details.
Patch / fix
- facebook parlai 1.1.0
Exploit prediction
1.79% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.4 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- facebookresearch ParlAI
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879
patch, third-party-advisory
-
github.com
/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725
patch, third-party-advisory
-
github.com
/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg
patch, third-party-advisory
Sources
- CVE List CVE-2021-39207
- NVD CVE-2021-39207
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.