Summary
VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files
References
Related vulnerabilities
All Supply chain →- HIGHGHSA-869J-R97X-HX2G
Anki's local HTTP server does not sufficiently validate requests
- MEDIUMGHSA-JV2J-MQMW-XVV5
SurrealDB: Denial of Service via deep operator chains
- MEDIUMGHSA-HV6H-HC26-Q48P
SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals
- MEDIUMGHSA-H4H3-3RFJ-X6FQ
SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field
- HIGHGHSA-CC8F-FCX3-GPJR
SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter
- MEDIUMGHSA-H5RG-8P7F-47G2
SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch