CVE-2017-2810

An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability.

Score

CVSS 3.0 9.8 Critical

Status

Modified - talos-cna@cisco.com

Published

2017-06-14

Last modified

2024-08-05

Affected products

• Tablib (Kenneth Reitz)
• Tablib (Python)

References

• http://www.securityfocus.com/bid/99076
• https://security.gentoo.org/glsa/201811-18
• https://talosintelligence.com/vulnerability_reports/TALOS-2017-0307