CVE-2021-43811

Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An attacker can add malicious code to the config file of a trained model and attempt to convince users to download and run it. If users run the model, the embedded code will run locally. The issue is fixed in version 2.3.24.

• CWE-94

• https://github.com/awslabs/sockeye/pull/964Patch, Third Party Advisory
• https://github.com/awslabs/sockeye/releases/tag/2.3.24Release Notes, Third Party Advisory
• https://github.com/awslabs/sockeye/security/advisories/GHSA-ggmr-44cv-24pmThird Party Advisory
• https://github.com/awslabs/sockeye/pull/964Patch, Third Party Advisory
• https://github.com/awslabs/sockeye/releases/tag/2.3.24Release Notes, Third Party Advisory
• https://github.com/awslabs/sockeye/security/advisories/GHSA-ggmr-44cv-24pmThird Party Advisory

Published

Dec 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43806Tuleap is a Libre and Open Source tool for end to end tracea…8.8
• CVE-2021-43807Opencast is an Open Source Lecture Capture & Video Managemen…6.5
• CVE-2021-43808Laravel is a web application framework. Laravel prior to ver…6.1
• CVE-2021-43809`Bundler` is a package for managing application dependencies…7.3
• CVE-2021-4381The uListing plugin for WordPress is vulnerable to authoriza…9.8
• CVE-2021-43810Admidio is a free open source user management system for web…6.1
• CVE-2021-43812The Auth0 Next.js SDK is a library for implementing user aut…6.1
• CVE-2021-43813Grafana is an open-source platform for monitoring and observ…4.3
• CVE-2021-43814Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2021-43815Grafana is an open-source platform for monitoring and observ…4.3
• CVE-2021-43816containerd is an open source container runtime. On installat…9.1
• CVE-2021-43817Collabora Online is a collaborative online office suite base…6.1