An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability.
Scores
Version
Score
Vector
Scored by
CVSS 3.0
HIGH 7.5
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
talos
CVSS 3.0
HIGH 7.5
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD · talos-cna@cisco.com (Secondary)
CVSS 3.0
CRITICAL 9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD · nvd@nist.gov (Primary)
CVSS 2.0
HIGH 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
NVD · nvd@nist.gov (Primary)
Advisories
GHSA-gcr6-rf47-jrgf — Loaded Databook of Tablib prone to python insertion resulting in command execution
PYSEC-2017-95 — An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulti
