CVE-2021-24040: facebook parlai Deserialization of Untrusted Data
Vulnerability summary
CVE-2021-24040 is a high (CVSS 8.8) Deserialization of Untrusted Data vulnerability in facebook parlai. EPSS estimates a 17.35% chance of exploitation in the next 30 days, higher than 97% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 10-09-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding unsafe loader users should update to version above v1.1.0. If upgrading is not possible then users can change the Loader used to SafeLoader as a workaround. See commit 507d066ef432ea27d3e201da08009872a2f37725 for details.
CVSS metrics
4 scores · 2 sources · 3 versions- OSV · PypiEcosystem advisory · calculated8.4HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:LDiffers
EPSS trend
Probability
17.35%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 17.35% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Facebook ParlAI 1.0.0 - Deserialization of Untrusted Data in parlai
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Facebook1 product
- parlai≥ unspecified, < 1.1.0 | < 1.1.0
PyPI1 product
- parlai< 1.1.0 | < 4374fa2aba383db6526ab36e939eb1cf8ef99879
2 vendors · 2 products
References
13 links- github.com/facebookresearch/ParlAI/releases/tag/v1.1.0X Refsource MISCWEBRelease NotesThird Party Advisory
- github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mggX Refsource CONFIRMWEBAdvisoryPatchThird Party Advisory
- packetstormsecurity.com/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.htmlX Refsource MISCWEBExploitThird Party AdvisoryVDB Entry
- github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879WEBFIXPatchThird Party Advisory
- github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725WEBFIXPatchThird Party Advisory