{"answers":{"affected":"2 open source packages ship an affected version, including vcrpy.","exploited":"There is no known exploitation of GHSA-rpj2-4hq8-938g in the wild and no public exploit code.","fix":"Upgrade vcrpy to 8.2.1 or later.","what":"GHSA-rpj2-4hq8-938g is an unsafe deserialization vulnerability in vcrpy, published on 19 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-rpj2-4hq8-938g and fix it if it is affected.\n\nWhat it is: GHSA-rpj2-4hq8-938g is an unsafe deserialization vulnerability in vcrpy, published on 19 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-rpj2-4hq8-938g in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- vcrpy (PyPI): affected all versions; fixed in 8.2.1\n- vcrpy (PyPI): affected all versions; fixed in 8.2.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-rpj2-4hq8-938g/ (Markdown: https://insights.sbomify.com/GHSA-rpj2-4hq8-938g/index.md)","id":"GHSA-rpj2-4hq8-938g","markdown":"https://insights.sbomify.com/GHSA-rpj2-4hq8-938g/index.md","name":"GHSA-rpj2-4hq8-938g","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"patch","impacts":["code_execution"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Python testing library","requires_auth":"none","summary":"Attackers can execute arbitrary code by supplying malicious YAML cassette files to vcrpy, which uses unsafe deserialization loaders.","user_interaction":"required","vuln_class":"deserialization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n\nvcrpy deserializes YAML cassette files with PyYAML's object-constructing loader (`yaml.CLoader` / `yaml.Loader`) instead of the safe loader (`yaml.CSafeLoader` / `yaml.SafeLoader`). A cassette containing a `!!python/object/apply:` (or similar) tag therefore executes arbitrary Python code the moment the cassette is loaded — including through the normal `VCR().use_cassette()` path, before any HTTP interaction is replayed.\n\nThis is **not** limited to environments lacking the libYAML C extension. `CLoader` uses the C parser but PyYAML's full Python *constructor*, so Python\nobject tags execute under `CLoader` exactly as under the pure-Python `Loader`. Confirmed against vcrpy 8.1.1 + PyYAML 6.0.3 with `CLoader` active.\n\n### Affected component\n\n- `vcr/serializers/yamlserializer.py` — `deserialize()` → `yaml.load(cassette_string, Loader=Loader)` where `Loader` is `CLoader`/`Loader`. Reached on **every** cassette load.\n- `vcr/migration.py` (~line 107) — `yaml.load(preprocess_yaml(...), Loader=Loader)`. A second sink reached when the migration tool is run on a `.yaml` file. `preprocess_yaml()` only strips three known legacy tags, so other tags still execute.\n\nPresent in all releases inspected, 1.0.0 through 8.1.1.\n\n### Proof of concept\n\n```python\nimport vcr, requests\n\n# Attacker-supplied cassette. The payload sits in an ignored top-level key\n# so the rest of the cassette stays valid; it fires during load.\nopen(\"evil.yaml\", \"w\").write(\"\"\"interactions:\n- request:\n    body: null\n    headers: {Accept: ['*/*']}\n    method: GET\n    uri: http://example.com/\n  response:\n    body: {string: ok}\n    headers: {Content-Type: ['text/plain']}\n    status: {code: 200, message: OK}\n_x: !!python/object/apply:os.system ['touch /tmp/VCRPY_YAML_RCE']\nversion: 1\n\"\"\")\n\nwith vcr.use_cassette(\"evil.yaml\"):      # \u003c-- /tmp/VCRPY_YAML_RCE created here\n    requests.get(\"http://example.com/\")\n```\n\nLoading the cassette creates `/tmp/VCRPY_YAML_RCE`, demonstrating arbitrary command execution. Any Python callable can be invoked this way.\n\n### Impact\n\nArbitrary code execution in the process that loads the cassette, with that process's full privileges. Realistic delivery paths:\n\n- A malicious cassette added in a pull request and loaded when CI runs the tests.\n- A poisoned shared test-fixture repository or cassette artifact store.\n- \"Updated recorded HTTP fixtures\" social-engineering.\n\nBecause cassettes are typically loaded by test suites in CI/CD and on developer machines, the exposed secrets are exactly the high-value ones in those environments: CI deployment credentials, cloud IAM roles, registry/publishing tokens, and source access.\n\n### Patch\n\nUse the safe loader in `vcr/serializers/yamlserializer.py`:\n\n```python\ntry:\n    from yaml import CDumper as Dumper\n    from yaml import CSafeLoader as Loader\nexcept ImportError:\n    from yaml import Dumper\n    from yaml import SafeLoader as Loader\n\ndef deserialize(cassette_string):\n    return yaml.load(cassette_string, Loader=Loader)\n```\n\nApply the same `SafeLoader` change in `vcr/migration.py`.\n\nThis is backwards compatible: vcrpy cassettes only contain standard YAML (scalars/lists/maps plus `!!binary`, all supported by `SafeLoader`/`CSafeLoader`), so existing cassettes load unchanged. vcrpy's `serialize.deserialize()` already catches `yaml.constructor.ConstructorError`, so a Python-tagged cassette now surfaces as the existing \"old cassette format\" `ValueError` instead of executing.\n\nRecommended hardening: add a regression test that loads a cassette containing `!!python/object/apply:os.system` and asserts a `ConstructorError`/`ValueError` and that no side effect occurs.","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files","id":"GHSA-rpj2-4hq8-938g","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"deserialization","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":["8.2.1"],"introduced":["0"],"last_affected":[],"package":"vcrpy","purl":null,"source":"GHSA-rpj2-4hq8-938g"},{"ecosystem":"PyPI","fixed":["8.2.1"],"introduced":["0"],"last_affected":[],"package":"vcrpy","purl":"pkg:pypi/vcrpy","source":"GHSA-rpj2-4hq8-938g"}],"products":null,"published":"2026-06-19","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can execute arbitrary code by supplying malicious YAML cassette files to vcrpy, which uses unsafe deserialization loaders.","url":"https://insights.sbomify.com/GHSA-rpj2-4hq8-938g/"}