Description:
Loading a config can execute arbitrary code. tools/engine/config.py parses YAML with
yaml.load(..., Loader=yaml.Loader), PyYAML's unsafe full loader, at line 121 (config file load, plus the BASE
recursive include-merge) and in the CLI ArgsParser (lines 35 and 43). yaml.Loader constructs arbitrary Python
objects from tags such as !!python/object/apply:os.system, so a crafted config.yml runs commands at parse time.
The config path is user-supplied via the documented python train.py -c <config.yml> workflow (and the BASE
include chain), parsed before training. This is deserialization of untrusted data (CWE-502).
I'm keeping this public report to the diagnosis and withholding a working proof-of-concept, since the code is
currently unpatched. Full reproduction available privately if you enable private vulnerability reporting or share an email.
To Reproduce:
Withheld publicly to avoid publishing a working exploit before a fix. Mechanism: a config.yml (or a BASE-included
file) containing a Python-object YAML tag is executed by yaml.load(..., Loader=yaml.Loader) when loaded via the
documented python train.py -c <config.yml> workflow (Config(config_path)). Full PoC available privately.
Expected behavior:
Config loading should only read data; never construct arbitrary objects or execute code.
Additional context:
Suggested fix (one line): replace Loader=yaml.Loader with Loader=yaml.SafeLoader at each call site in
tools/engine/config.py (lines 35, 43, 121).
Configs are plain mappings/lists/scalars, so SafeLoader is a drop-in with no functional change.
CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE requested. Note: UnionST vendors this config loader (affected downstream). Screenshots/Desktop/Smartphone: N/A. Thanks for OpenOCR!
Description:
Loading a config can execute arbitrary code. tools/engine/config.py parses YAML with
yaml.load(..., Loader=yaml.Loader), PyYAML's unsafe full loader, at line 121 (config file load, plus the BASE
recursive include-merge) and in the CLI ArgsParser (lines 35 and 43). yaml.Loader constructs arbitrary Python
objects from tags such as !!python/object/apply:os.system, so a crafted config.yml runs commands at parse time.
The config path is user-supplied via the documented
python train.py -c <config.yml>workflow (and the BASEinclude chain), parsed before training. This is deserialization of untrusted data (CWE-502).
I'm keeping this public report to the diagnosis and withholding a working proof-of-concept, since the code is
currently unpatched. Full reproduction available privately if you enable private vulnerability reporting or share an email.
To Reproduce:
Withheld publicly to avoid publishing a working exploit before a fix. Mechanism: a config.yml (or a BASE-included
file) containing a Python-object YAML tag is executed by yaml.load(..., Loader=yaml.Loader) when loaded via the
documented
python train.py -c <config.yml>workflow (Config(config_path)). Full PoC available privately.Expected behavior:
Config loading should only read data; never construct arbitrary objects or execute code.
Additional context:
Suggested fix (one line): replace Loader=yaml.Loader with Loader=yaml.SafeLoader at each call site in
tools/engine/config.py (lines 35, 43, 121).
Configs are plain mappings/lists/scalars, so SafeLoader is a drop-in with no functional change.
CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE requested. Note: UnionST vendors this config loader (affected downstream). Screenshots/Desktop/Smartphone: N/A. Thanks for OpenOCR!