CVE-2023-22970

High

7.8/10

Summary

Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file.

Attack Complexity: LOW
Attack Vector: LOCAL
Integrity Impact: HIGH
Scope: UNCHANGED
User Interaction: REQUIRED
Privileges Required: NONE
Confidentiality Impact: HIGH
Availability Impact: HIGH

References

Advisory Timeline

Published May 26, 2023