Safety vulnerability ID: 35722
The information on this page was manually curated by our Cybersecurity Intelligence Team.
An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file method in io_utils.py in django_make_app 0.1.3. A YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability.
Latest version: 0.1.3
Define models and fields using YAML and generate app for Django with views, forms, templates etc.
An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file method in io_utils.py in django_make_app 0.1.3. A YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability.
MISC:https://github.com/illagrenan/django-make-app/issues/5: https://github.com/illagrenan/django-make-app/issues/5
MISC:https://joel-malwarebenchmark.github.io/blog/2017/11/12/cve-2017-16764-vulnerability-in-django-make-app/: https://joel-malwarebenchmark.github.io/blog/2017/11/12/cve-2017-16764-vulnerability-in-django-make-app/
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application