-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from using PyYAML's unsafe Loader and Constructor classes, which parse YAML with full object deserialization capabilities. The commit diff shows the fix replaced yaml.Loader with yaml.SafeLoader and yaml.constructor.Constructor with SafeConstructor. The original classes in yaql_yaml_loader.py directly inherited from these unsafe bases, making them the root cause. The YAML parsing in MuranoPL and UI files used these vulnerable loaders, allowing attackers to exploit extended YAML tags for code execution.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| murano | pip | < 1.0.3 | 1.0.3 |
| murano-dashboard | pip | < 1.0.3 | 1.0.3 |
| python-muranoclient | pip | < 0.7.3 | 0.7.3 |
| murano-dashboard | pip | >= 2.0.0, < 2.0.1 | 2.0.1 |
| python-muranoclient | pip | >= 0.8.0, < 0.8.5 | 0.8.5 |
A Semantic Attack on Google Gemini - Read the Latest Research