Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Deserialization of Untrusted Data in parlai
Vulnerability Description
parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding unsafe loader users should update to version above v1.1.0. If upgrading is not possible then users can change the Loader used to SafeLoader as a workaround. See commit 507d066ef432ea27d3e201da08009872a2f37725 for details.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Vulnerability Type
可信数据的反序列化
Vulnerability Title
parlai 代码问题漏洞
Vulnerability Description
parlai是用于在各种公开可用的对话数据集上训练和评估 AI 模型。 parlai 存在代码问题漏洞，该漏洞源于在受影响的版本中，不安全的加载包很容易受到YAML反序列化攻击。攻击者可利用该漏洞导致任意代码执行。
CVSS Information
N/A
Vulnerability Type
N/A