High severity7.8NVD Advisory· Published Dec 8, 2021· Updated Jun 17, 2026
CVE-2021-43811
CVE-2021-43811
Description
Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An attacker can add malicious code to the config file of a trained model and attempt to convince users to download and run it. If users run the model, the embedded code will run locally. The issue is fixed in version 2.3.24.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
sockeyePyPI | < 2.3.24 | 2.3.24 |
Affected products
3Patches
Vulnerability mechanics
References
6- github.com/awslabs/sockeye/pull/964nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-ggmr-44cv-24pmghsaADVISORY
- github.com/awslabs/sockeye/releases/tag/2.3.24nvdRelease NotesThird Party AdvisoryWEB
- github.com/awslabs/sockeye/security/advisories/GHSA-ggmr-44cv-24pmnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2021-43811ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/sockeye/PYSEC-2021-848.yamlghsaWEB
News mentions
0No linked articles in our index yet.