{"id":"GHSA-h72c-w3q3-55qq","summary":"OS Command Injection in jw.util","details":"An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used.","aliases":["CVE-2020-13388","PYSEC-2020-341"],"modified":"2024-02-16T08:18:06.025087Z","published":"2021-06-02T21:45:12Z","database_specific":{"github_reviewed_at":"2021-05-14T20:59:12Z","nvd_published_at":"2020-05-22T17:15:00Z","cwe_ids":["CWE-78"],"severity":"CRITICAL","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13388"},{"type":"WEB","url":"https://joel-malwarebenchmark.github.io"},{"type":"WEB","url":"https://joel-malwarebenchmark.github.io/blog/2020/04/27/cve-2020-13388-jw-util-vulnerability"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20200528-0002"}],"affected":[{"package":{"name":"jw-util","ecosystem":"PyPI","purl":"pkg:pypi/jw-util"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3"}]}],"versions":["-class.-jw.util.version.Version-","1.0a","1.0dev1","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.2","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5a0","1.5a1","1.5a2","1.5a3","1.5a4","1.5b0","1.6","1.7","1.8","1.9","1.9.1","1.9.2","2","2.0","2.0.1","2.0a0","2.0a1","2.0a2","2.0a3","2.0b0","2.1","2.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-h72c-w3q3-55qq/GHSA-h72c-w3q3-55qq.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}