CVE-2021-38305

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-09 · updated 2026-06-17
Weakness: CWE-434

Description

23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale.

Affected products

23Andme Yamale: before 3.0.8 — fixed in 3.0.8

How to fix

Upgrade to a fixed version: 23Andme Yamale 3.0.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-38305 or the next vulnerability affects your stack