-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from using yaml.load() with the default unsafe Loader parameter instead of yaml.safe_load(). Both functions in the ChatGPT and OpenAPI tool specifications directly process remote YAML content without proper sanitization. The GitHub patch explicitly replaces these vulnerable calls with safe_load(), and the CVE description specifically identifies these two loaders as the attack vectors. The Jupyter notebook and README changes demonstrate the pattern was widespread, but the core vulnerability resides in the init methods handling external YAML inputs.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| llama-hub | pip | < 0.0.67 | 0.0.67 |
PythonPythonOngoing coverage of React2Shell