ZDI-26-934: (0Day) Meta fairseq FConvLanguageModel YAML File Parsing Code Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta fairseq. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must convince the target to open a malicious YAML file. Exploitation then allows the attacker to execute arbitrary code on the affected fairseq installation.
Who is most exposed?
Users or systems that open YAML files from untrusted or attacker-controlled sources are exposed. The available information does not state whether any default configuration automatically processes such files.
What can be done before a patch is available?
Do not open untrusted YAML files in affected Meta fairseq installations. Treat YAML files received through email, downloads, shared storage, or other untrusted channels as potentially malicious.