CVE-2011-4103
Django-piston and Django-tastypie do not properly deserialize YAML data
emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
Exploit likelihood
What each source reports
NVD Score used
emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
- Record
CVE-2011-4103- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
- Record
CVE-2011-4103- Updated
- 2026-11-02
EUVDEUVD-2014-0005 No score
emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
- Record
EUVD-2014-0005- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pvhp-v9qp-xf5r
Django-piston and Django-tastypie do not properly deserialize YAML data
emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
Django Tastypie has a very similar vulnerability.
- Record
GHSA-pvhp-v9qp-xf5r- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-pvhp-v9qp-xf5r
Django-piston and Django-tastypie do not properly deserialize YAML data
emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
Django Tastypie has a very similar vulnerability.
- Record
GHSA-pvhp-v9qp-xf5r- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVPYSEC-2014-24 No score
emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
- Record
PYSEC-2014-24- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
django-pistonPyPI |
0.2.0 up to 0.2.2.1 | 0.2.2.1 |
python-django-pistonDebian:6.0 |
before 0.2.2-1+squeeze1, plus listed versions 0.2.2-1 |
0.2.2-1+squeeze1 |
django-pistonPyPI |
0.2.0 up to 0.2.2.1, plus listed versions 0.20.2.10.2.2 |
0.2.2.1 |
django-pistonPyPI |
before 0.2.3, plus listed versions 0.0.10.20.2.10.2.20.2.2.1 |
0.2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-4103 is a high vulnerability (CVSS 7.5) in Djangoproject Piston, published November 11, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.43%, the 84th percentile. Fixed in django-piston 0.2.2.1.
References
bugzilla.redhat.com/show_bug.cgi?id=750658
bitbucket.org/jespern/django-piston/commits/91bdaec89543
debian.org/security/2011/dsa-2344
djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases
openwall.com/lists/oss-security/2011/11/01/10
nvd.nist.gov/vuln/detail/CVE-2011-4103
github.com/advisories/GHSA-pvhp-v9qp-xf5r