CVE-2021-23338

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Feb 15, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-233396.5This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-CVE-2021-23343.5Vulnerability in the Oracle Database - Enterprise Edition Data Redaction component of Oracle Database Server. Supported versions that are afCVE-2021-233407.1This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CVE-2021-233417.5The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tCVE-2021-233426.1This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScrCVE-2021-233437.5All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPCVE-2021-233449.8The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.CVE-2021-233455.3All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endCVE-2021-233465.3This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could causeCVE-2021-233474.8The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO CVE-2021-233488.8This affects the package portprocesses before 1.0.5. If (attacker-controlled) user input is given to the killProcess function, it is possiblCVE-2021-23353.5Vulnerability in the Oracle Database - Enterprise Edition Data Redaction component of Oracle Database Server. Supported versions that are af
CVE-2021-23338: High severity, CVSS 7.2 | Vulnix