CVE-2023-49297

PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserilization will result in arbitrary code execution. A maliciously crafted YAML file can cause arbitrary code execution if PyDrive2 is run in the same directory as it, or if it is loaded in via `LoadSettingsFile`. This is a deserilization attack that will affect any user who initializes GoogleAuth from this package while a malicious yaml file is present in the same directory. This vulnerability does not require the file to be directly loaded through the code, only present. This issue has been addressed in commit `c57355dc` which is included in release version `1.16.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-502

• https://github.com/iterative/PyDrive2/commit/c57355dc2033ad90b7050d681b2c3ba548ff0004Patch
• https://github.com/iterative/PyDrive2/security/advisories/GHSA-v5f6-hjmf-9mc5Exploit, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYR5SJKOFSSXFV3E3D2SLXBUBA5WMJJG/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K34YWTDKBAYWZPOAKBYDM72WIFL5CAYW/
• https://github.com/iterative/PyDrive2/commit/c57355dc2033ad90b7050d681b2c3ba548ff0004Patch
• https://github.com/iterative/PyDrive2/security/advisories/GHSA-v5f6-hjmf-9mc5Exploit, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYR5SJKOFSSXFV3E3D2SLXBUBA5WMJJG/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K34YWTDKBAYWZPOAKBYDM72WIFL5CAYW/

Published

Dec 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49291tj-actions/branch-names is a Github action to retrieve branc…9.8
• CVE-2023-49292ecies is an Elliptic Curve Integrated Encryption Scheme for …4.8
• CVE-2023-49293Vite is a website frontend framework. When Vite's HTML trans…6.1
• CVE-2023-49294Asterisk is an open source private branch exchange and telep…7.5
• CVE-2023-49295quic-go is an implementation of the QUIC protocol (RFC 9000,…6.5
• CVE-2023-49296The Arduino Create Agent allows users to use the Arduino Cre…6.1
• CVE-2023-49298OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain s…7.5
• CVE-2023-49299Improper Input Validation vulnerability in Apache DolphinSch…8.8
• CVE-2023-4930The Front End PM WordPress plugin before 11.4.3 does not blo…6.5
• CVE-2023-4931Uncontrolled search path element vulnerability in Plesk Inst…7.8
• CVE-2023-49312Precision Bridge PrecisionBridge.exe (aka the thick client) …9.1
• CVE-2023-49313A dylib injection vulnerability in XMachOViewer 0.04 allows …9.8