漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
CWL Viewer: deserialization of untrusted data can lead to complete takeover by an attacker
Vulnerability Description
cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de (dated 2021-09-30) contains a patch. There are no available workarounds aside from installing the patch. The SnakeYaml constructor, by default, allows any data to be parsed. To fix the issue the object needs to be created with a `SafeConstructor` object, as seen in the patch.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Vulnerability Type
可信数据的反序列化
Vulnerability Title
Cwlviewer 代码问题漏洞
Vulnerability Description
Cwlviewer是一个用于查看和共享通用工作流语言工作流的 Web 应用程序。 cwlviewer 存在代码问题漏洞，该漏洞源于SnakeYaml 构造函数允许解析任何数据。
CVSS Information
N/A
Vulnerability Type
N/A