Facebook Parlai vulnerabilities

2 CVEs affecting Facebook Parlai, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-39207, published 2021-09-10.

More from Facebook.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-24040, published 2021-09-10. Critical severity, CVSS 9.8. EPSS: 17.4% chance of exploitation in the next 30 days. Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar…
• CVE-2021-39207, published 2021-09-10. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by…