CVE-2023-47204 transmute-core unsafe YAML deserialization vulnerability
Attackers can execute arbitrary Python code via unsafe YAML deserialization in the transmute-core library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-47204?
CVE-2023-47204 is a critical unsafe deserialization vulnerability in n/a, published on 2 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code.
Weakness: CWE-502
Which versions are affected by CVE-2023-47204?
3 open source packages ship an affected version, including transmute-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
transmute-core PyPI | All versions | 1.13.5 |
transmute-core PyPI | All versions | 1.13.5 |
transmute-core PyPI | All versions | 1.13.5 |
Products include Toumorokoshi Transmute-Core.
How do I fix CVE-2023-47204?
Upgrade transmute-core to 1.13.5 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-47204 being exploited?
There is no known exploitation of CVE-2023-47204 in the wild and no public exploit code.
Sources
Also known as GHSA-w9cp-3x79-2p8p, PYSEC-2023-223.