Threats tagged 'ghsa-3rqm-3mpx-jvr5'

Treeio versions through 2.0 have an insecure deserialization vulnerability in the UpdateRecord.get_format_strings and ModuleSetting.loads functions. This flaw allows staff users to execute arbitrary code by storing crafted base64-encoded pickle payloads in the UpdateRecord format_strings field via the Django admin interface. When news feeds render, the malicious pickle data is deserialized, leading to code execution as the web server user.