Back
CVE-2017-16618
CRITICAL
An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before 2.0.0a12. A "Load YAML" string or file (aka load_yaml or load_yamlf) can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used. An attacker can insert Python into loaded YAML to trigger this vulnerability.
Published: Nov 8, 2017
Modified: Jun 17, 2026
NVD-CWE-noinfo
CVSS Metrics
CVSSv3
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products (12)
| Vendor | Product | Version |
|---|---|---|
| owlmixin_project | owlmixin | * < 2.0.0 |
| owlmixin_project | owlmixin | 2.0.0 |
| owlmixin_project | owlmixin | 2.0.0 |
| owlmixin_project | owlmixin | 2.0.0 |
| owlmixin_project | owlmixin | 2.0.0 |
| owlmixin_project | owlmixin | 2.0.0 |
| owlmixin_project | owlmixin | 2.0.0 |
| owlmixin_project | owlmixin | 2.0.0 |
| owlmixin_project | owlmixin | 2.0.0 |
| owlmixin_project | owlmixin | 2.0.0 |
| owlmixin_project | owlmixin | 2.0.0 |
| owlmixin_project | owlmixin | 2.0.0 |
GitHub Security Advisory GHSA-ccmq-qvcp-5mrm
Unsafe deserialization in owlmixin
pip
owlmixin
< 2.0.0
Fixed: 2.0.0
References (6)
- https://github.com/tadashi-aikawa/owlmixin/commit/5d0575303f6df869a515ced4285f24ba721e0d4e Patch, Third Party Advisory
- https://github.com/tadashi-aikawa/owlmixin/issues/12 Exploit, Patch, Third Party Advisory
- https://joel-malwarebenchmark.github.io/blog/2017/11/08/cve-2017-16618-convert-through-owlmixin/ Exploit, Third Party Advisory
- https://github.com/tadashi-aikawa/owlmixin/commit/5d0575303f6df869a515ced4285f24ba721e0d4e Patch, Third Party Advisory
- https://github.com/tadashi-aikawa/owlmixin/issues/12 Exploit, Patch, Third Party Advisory
- https://joel-malwarebenchmark.github.io/blog/2017/11/08/cve-2017-16618-convert-through-owlmixin/ Exploit, Third Party Advisory
Risk Scores
CVSS Score
9.8 / 10
EPSS Score
4.47%
Top 9% most likely to be exploited
Threat Score
40.5 / 100
Data Sources
NVD
EPSS
GitHub