{"id":"PYSEC-2024-315","details":"Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafe_load function at cli.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted YML file.","aliases":["CVE-2024-28423"],"modified":"2026-08-04T13:45:07.389974238Z","published":"2024-03-14T19:15:50.877Z","withdrawn":"2026-07-30T12:39:29Z","references":[{"type":"PACKAGE","url":"https://github.com/bayuncao/vul-cve-15"}],"affected":[{"package":{"name":"diagrams","ecosystem":"PyPI","purl":"pkg:pypi/diagrams"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.1.0"}]}],"versions":["0.1.0","0.10.0","0.11.0","0.12.0","0.13.0","0.13.1","0.14.0","0.15.0","0.16.0","0.17.0","0.18.0","0.19.0","0.19.1","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.20.0","0.21.0","0.21.1","0.22.0","0.23.1","0.23.2","0.23.3","0.23.4","0.24.0","0.24.1","0.24.3","0.24.4","0.25.0","0.25.1","0.3.0","0.4.0","0.5.0","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.8.0","0.8.1","0.8.2","0.9.0"],"ecosystem_specific":{},"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/diagrams/PYSEC-2024-315.yaml"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}