6.6

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2021-23338

GHSA ID

GHSA-hjr4-fhgp-23g9

EPSS Score

0.92159%

CWE

CWE-94

Published

5/24/2022

Updated

10/14/2024

KEV Status

Technology

Python

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2021-23338

CVE-2021-23338: qlib Deserialization of Untrusted Data vulnerability

This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2021-23338

CVE-2021-23338:

6.6

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2021-23338

GHSA ID

GHSA-hjr4-fhgp-23g9

EPSS Score

0.92159%

CWE

CWE-94

Published

5/24/2022

Updated

10/14/2024

KEV Status

Technology

Python

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pyqlib	pip	< 0.7.0	0.7.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description explicitly states the workflow function in the CLI component uses unsafe YAML loading.
The provided exploit demonstrates code execution via malicious YAML payload passed to cli.workflow().
The CWE-502 (Deserialization of Untrusted Data) classification matches the unsafe yaml.load() pattern.
PyYAML's yaml.load() without a SafeLoader is a well-known anti-pattern for deserialization vulnerabilities.
The patched version (0.7.0) likely replaced yaml.load() with yaml.safe_load() or equivalent safe loading method.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.6

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2021-23338: qlib Deserialization of Untrusted Data vulnerability

CVE-2021-23338:

6.6

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

6.6

6.6

Technical Details

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

CVE-2021-23338: qlib Deserialization of Untrusted Data vulnerability

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI