ZDI-CAN-29592: ZDI-26-933: (0Day) Meta fairseq MultiresHubertModel YAML File Parsing Code Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta fairseq. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must persuade a target user to open a malicious YAML file. Exploitation requires user interaction; the available information does not indicate that simply receiving or storing the file is sufficient.
Who is realistically exposed?
Users of affected Meta fairseq installations who open YAML files from untrusted or attacker-controlled sources are exposed. The issue can result in arbitrary code execution in the context of the user or process opening the malicious file.
How urgent is remediation?
ZDI assigned a CVSS score of 7.8, indicating a high-severity issue. Prioritize affected systems where users or automated workflows may open externally supplied YAML files.