CVE-2017-16618

Name: CVE-2017-16618
Creator: NVD / NIST
Published: 2017-11-08T03:29:00.277+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 4.44%

Last modified Jun 17, 2026

CVE-2017-16618 is a vulnerability of currently unknown severity. An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before 2.0.0a12. A "Load YAML" string or file (aka load_yaml or load_yamlf) can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used. EPSS estimates a 4.44% chance of exploitation in the next 30 days.

Description

An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before 2.0.0a12. A "Load YAML" string or file (aka load_yaml or load_yamlf) can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used. An attacker can insert Python into loaded YAML to trigger this vulnerability.

Metrics

EPSS Probability

4.44%

90.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Vendor	Product	Versions	Update
Owlmixin Project	Owlmixin	< 2.0.0	—
Owlmixin Project	Owlmixin	2.0.0	Alpha1

References

https://github.com/tadashi-aikawa/owlmixin/commit/5d0575303f6df869a515ced4285f24ba721e0d4ePatch, Third Party Advisory
https://github.com/tadashi-aikawa/owlmixin/issues/12Exploit, Patch, Third Party Advisory
https://joel-malwarebenchmark.github.io/blog/2017/11/08/cve-2017-16618-convert-through-owlmixin/Exploit, Third Party Advisory
https://github.com/tadashi-aikawa/owlmixin/commit/5d0575303f6df869a515ced4285f24ba721e0d4ePatch, Third Party Advisory
https://github.com/tadashi-aikawa/owlmixin/issues/12Exploit, Patch, Third Party Advisory
https://joel-malwarebenchmark.github.io/blog/2017/11/08/cve-2017-16618-convert-through-owlmixin/Exploit, Third Party Advisory

Timeline

Published: Nov 8, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-16618?

How severe is CVE-2017-16618?

Severity scoring for CVE-2017-16618 is pending analysis. The EPSS model estimates a 4.44% probability of exploitation in the next 30 days.

How do I fix CVE-2017-16618?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-16618?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST