{"data":{"id":"f23249a1-c275-431a-b735-effdc9269518","title":"CVE-2021-43811: Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses…","summary":"CVE-2021-43811 affects Sockeye, the open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch, in versions below 2.3.24. These versions use unsafe YAML loading of model and data configuration files, which can execute arbitrary code embedded in a config file. An attacker must add malicious code to a trained model's config file and convince users to download and run that model, after which the embedded code runs locally.","solution":"The issue is fixed in version 2.3.24.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-43811","publishedAt":"2021-12-09T04:15:08.123Z","cveId":"CVE-2021-43811","cweIds":["CWE-94"],"cvssScore":"7.8","cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["sockeye@< 2.3.24 (fixed: 2.3.24)"],"affectedPackageNames":["sockeye"],"affectedPackageRefs":["pypi:sockeye"],"affectedVendors":[],"affectedVendorsRaw":["Sockeye","PyTorch"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Sockeye unsafe YAML loading of model config files allows code execution","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.02474,"epssCheckedAt":"2026-11-04T00:12:27.430Z","kevDateAdded":null,"advisoryAliases":["GHSA-ggmr-44cv-24pm"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:58:56.575Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2021-11-05T09:29:29.052Z","daysToFix":-34,"fixCheckedAt":"2026-10-29T21:49:44.541Z","capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"sockeye","fixedVersion":"2.3.24","matchedVersion":"2.3.24","fixReleasedAt":"2021-11-05T09:29:29.052Z","daysToFix":-34,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:49:44.391Z"}]}}