GHSA-6h2x-4gjf-jc5w
autogluon.multimodal vulnerable to unsafe YAML deserialization
GHSA-6h2x-4gjf-jc5w is a vulnerability with no CVSS score yet in autogluon-multimodal, published September 21, 2022. No source lists public exploit code. Fixed in autogluon-multimodal 0.4.3.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.4.3autogluon-multimodal +3 more
Description
Impact
A potential unsafe deserialization issue exists within the autogluon.multimodal module, where YAML files are loaded via yaml.load() instead of yaml.safe_load(). The deserialization of untrusted data may allow an unprivileged third party to cause remote code execution, denial of service, and impact to both confidentiality and integrity.
Impacted versions: >=0.4.0;<0.4.3, >=0.5.0;<0.5.2.
Patches
The patches are included in autogluon.multimodal==0.4.3, autogluon.multimodal==0.5.2 and Deep Learning Containers 0.4.3 and 0.5.2.
Workarounds
Do not load data which originated from an untrusted source, or that could have been tampered with. Only load data you trust.
References
Affected packages
| Package | Affected | Fixed |
|---|---|---|
autogluon-multimodalPyPI | 0.4.0 up to 0.4.3 | 0.4.3 |
autogluon-multimodalPyPI | 0.5.0 up to 0.5.2 | 0.5.2 |
autogluon-multimodalPyPI | 0.4.0 up to 0.4.3, plus listed versions 0.4.3b202206160.4.3b202206170.4.3b202206180.4.3b202206190.4.3b202206200.4.3b202206210.4.3b20220622 | 0.4.3 |
autogluon-multimodalPyPI | 0.5.0 up to 0.5.2, plus listed versions 0.5.10.5.1b202206240.5.1b202206250.5.1b202206260.5.1b20220627 Show 31 moreShow less0.5.1b202206280.5.1b202206290.5.1b202206300.5.1b202207010.5.1b202207020.5.1b202207030.5.1b202207040.5.1b202207050.5.1b202207060.5.1b202207070.5.1b202207080.5.1b202207090.5.1b202207100.5.1b202207110.5.1b202207120.5.1b202207130.5.1b202207140.5.1b202207150.5.1b202207160.5.1b202207170.5.1b202207180.5.2b202207190.5.2b202207200.5.2b202207210.5.2b202207220.5.2b202207230.5.2b202207240.5.2b202207250.5.2b202207260.5.2b202207270.5.2b20220728 | 0.5.2 |
What each source reports
GitHub AdvisoriesNo score
autogluon.multimodal vulnerable to unsafe YAML deserialization
Impact
A potential unsafe deserialization issue exists within the autogluon.multimodal module, where YAML files are loaded via yaml.load() instead of yaml.safe_load(). The deserialization of untrusted data may allow an unprivileged third party to cause remote code execution, denial of service, and impact to both confidentiality and integrity.
Impacted versions: >=0.4.0;<0.4.3, >=0.5.0;<0.5.2.
Patches
The patches are included in autogluon.multimodal==0.4.3, autogluon.multimodal==0.5.2 and Deep Learning Containers 0.4.3 and 0.5.2.
Workarounds
Do not load data which originated from an untrusted source, or that could have been tampered with. Only load data you trust.
References
- Record
GHSA-6h2x-4gjf-jc5w- Weakness
- CWE-502
- Updated
- 2026-11-02
OSVNo score
autogluon.multimodal vulnerable to unsafe YAML deserialization
Impact
A potential unsafe deserialization issue exists within the autogluon.multimodal module, where YAML files are loaded via yaml.load() instead of yaml.safe_load(). The deserialization of untrusted data may allow an unprivileged third party to cause remote code execution, denial of service, and impact to both confidentiality and integrity.
Impacted versions: >=0.4.0;<0.4.3, >=0.5.0;<0.5.2.
Patches
The patches are included in autogluon.multimodal==0.4.3, autogluon.multimodal==0.5.2 and Deep Learning Containers 0.4.3 and 0.5.2.
Workarounds
Do not load data which originated from an untrusted source, or that could have been tampered with. Only load data you trust.
References
- Record
GHSA-6h2x-4gjf-jc5w- Weakness
- CWE-502
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.