From e2550a02ba3723060e8bac7514cbc464f99e95f8 Mon Sep 17 00:00:00 2001 From: BachDEV Date: Wed, 1 Apr 2026 02:04:25 +0700 Subject: [PATCH 1/2] fix(security): insecure yaml deserialization via `yaml.fullloader` The application uses `yaml.load(f, Loader=yaml.FullLoader)` to parse a configuration file (`config`) whose path can be controlled by a command-line argument. While `FullLoader` is safer than the default `yaml.load` without a specified loader, it still allows the construction of arbitrary Python objects. If an attacker can provide a specially crafted malicious YAML file, this can lead to arbitrary code execution on the system where the application is run. This is a severe vulnerability as it allows an attacker to execute arbitrary code with the privileges of the running application. Affected files: main.py, main.py Signed-off-by: BachDEV <1437214+bachdev@users.noreply.github.com> --- PW_FT_detection/main.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/PW_FT_detection/main.py b/PW_FT_detection/main.py index d3f7cd140..e7a522f58 100644 --- a/PW_FT_detection/main.py +++ b/PW_FT_detection/main.py @@ -8,7 +8,7 @@ def main(config:str='./config.yaml'): # Load and set configurations from the YAML file with open(config) as f: - cfg = Munch(yaml.load(f, Loader=yaml.FullLoader)) + cfg = Munch(yaml.safe_load(f)) if cfg.resume: model_path = cfg.weights From 645784f8e59fe0f67fba1724405861673c9ec452 Mon Sep 17 00:00:00 2001 From: BachDEV Date: Wed, 1 Apr 2026 02:04:27 +0700 Subject: [PATCH 2/2] fix(security): insecure yaml deserialization via `yaml.fullloader` The application uses `yaml.load(f, Loader=yaml.FullLoader)` to parse a configuration file (`config`) whose path can be controlled by a command-line argument. While `FullLoader` is safer than the default `yaml.load` without a specified loader, it still allows the construction of arbitrary Python objects. If an attacker can provide a specially crafted malicious YAML file, this can lead to arbitrary code execution on the system where the application is run. This is a severe vulnerability as it allows an attacker to execute arbitrary code with the privileges of the running application. Affected files: main.py, main.py Signed-off-by: BachDEV <1437214+bachdev@users.noreply.github.com> --- PW_FT_classification/main.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/PW_FT_classification/main.py b/PW_FT_classification/main.py index ec66333a1..a34ebb583 100644 --- a/PW_FT_classification/main.py +++ b/PW_FT_classification/main.py @@ -66,7 +66,7 @@ def main( os.environ["NUMEXPR_NUM_THREADS"] = str(np_threads) # Load and set configurations from the YAML file with open(config) as f: - conf = Munch(yaml.load(f, Loader=yaml.FullLoader)) + conf = Munch(yaml.safe_load(f)) conf.evaluate = evaluate conf.val = val conf.test = test