CVE-2019-3575

Name of the Vulnerable Software and Affected Versions Sqla yaml fixtures versions up to 0.9.1

Description The issue allows local users to execute arbitrary python code via the fixture text argument in the sqla yaml fixtures.load function. This can lead to code execution with the privileges of the user running the application.

Recommendations For Sqla yaml fixtures versions up to 0.9.1, consider restricting access to the sqla yaml fixtures.load function to minimize the risk of exploitation. As a temporary workaround, avoid using the fixture text argument in the sqla yaml fixtures.load function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.