CVE-2021-35196

Published: 2021-06-21T23:15Z

Last Modified: 2024-11-21T06:12Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

Manuskript through 0.12.0 allows remote attackers to execute arbitrary code via a crafted settings.pickle file in a project file, because there is insecure deserialization via the pickle.load() function in settings.py. NOTE: the vendor's position is that the product is not intended for opening an untrusted project file > MITRE Terms of Use apply – see LICENSE‑MITRE.txt