Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/yamale@2.2.0
purl pkg:pypi/yamale@2.2.0
Next non-vulnerable version 3.0.8
Latest non-vulnerable version 3.0.8
Risk
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-erwm-mscq-9yer
Aliases:
CVE-2021-38305
GHSA-435p-f82x-mxwm
PYSEC-2021-119
23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale.
3.0.8
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-02T04:14:15.269498+00:00 Pypa Importer Affected by VCID-erwm-mscq-9yer https://github.com/pypa/advisory-database/blob/main/vulns/yamale/PYSEC-2021-119.yaml 38.6.0