CVE-2021-38305

23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale.

• CWE-434

• https://github.com/23andMe/Yamale/pull/165Patch, Third Party Advisory
• https://github.com/23andMe/Yamale/releases/tag/3.0.8Release Notes, Third Party Advisory
• https://github.com/23andMe/Yamale/pull/165Patch, Third Party Advisory
• https://github.com/23andMe/Yamale/releases/tag/3.0.8Release Notes, Third Party Advisory

Published

Aug 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-38299Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access C…9.8
• CVE-2021-3830btcpayserver is vulnerable to Improper Neutralization of Inp…5.4
• CVE-2021-38300arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 ca…7.8
• CVE-2021-38302The Newsletter extension through 4.0.0 for TYPO3 allows SQL …9.8
• CVE-2021-38303A SQL injection vulnerability exists in Sureline SUREedge Mi…9.8
• CVE-2021-38304Improper input validation in the National Instruments NI-PAL…7.8
• CVE-2021-38306Network Attached Storage on LG N1T1*** 10124 devices allows …9.8
• CVE-2021-3831gnuboard5 is vulnerable to Improper Neutralization of Input …6.1
• CVE-2021-38311In Contiki 3.0, potential nonterminating acknowledgment loop…7.5
• CVE-2021-38312The Gutenberg Template Library & Redux Framework plugin <= 4…6.5
• CVE-2021-38314The Gutenberg Template Library & Redux Framework plugin <= 4…5.3
• CVE-2021-38315The SP Project & Document Manager WordPress plugin is vulner…6.1