-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unsafe YAML deserialization via PyYAML's yaml.load() method. The commit diff shows the vulnerable implementation was in utils.py's load_yaml function, which directly used yaml.load() with the default unsafe Loader. This matches the CWE-502 pattern and the advisory's root cause description. The patch explicitly changes this to yaml.safe_load(), confirming this was the vulnerable function.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nvflare | pip | < 2.1.2 | 2.1.2 |
Ongoing coverage of React2Shell