CVE-2021-39207

parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding unsafe loader users should update to version above v1.1.0. If upgrading is not possible then users can change the Loader used to SafeLoader as a workaround. See commit 507d066ef432ea27d3e201da08009872a2f37725 for details.

• CWE-502

• https://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879Patch, Third Party Advisory
• https://github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725Patch, Third Party Advisory
• https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mggPatch, Third Party Advisory
• https://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879Patch, Third Party Advisory
• https://github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725Patch, Third Party Advisory
• https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mggPatch, Third Party Advisory

Published

Sep 10, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39201WordPress is a free and open-source content management syste…5.4
• CVE-2021-39202WordPress is a free and open-source content management syste…5.4
• CVE-2021-39203WordPress is a free and open-source content management syste…6.5
• CVE-2021-39204Pomerium is an open source identity-aware access proxy. Envo…7.5
• CVE-2021-39205Jitsi Meet is an open source video conferencing application.…6.1
• CVE-2021-39206Pomerium is an open source identity-aware access proxy. Envo…8.6
• CVE-2021-39208SharpCompress is a fully managed C# library to deal with man…4.3
• CVE-2021-39209GLPI is a free Asset and IT management software package. In …8.8
• CVE-2021-3921firefly-iii is vulnerable to Cross-Site Request Forgery (CSR…4.3
• CVE-2021-39210GLPI is a free Asset and IT management software package. In …6.5
• CVE-2021-39211GLPI is a free Asset and IT management software package. Sta…5.3
• CVE-2021-39212ImageMagick is free software delivered as a ready-to-run bin…3.6