GHSA-6h2x-4gjf-jc5w: 
Python vulnerability analysis and mitigation

A high-severity unsafe YAML deserialization vulnerability was identified in the autogluon.multimodal module (GHSA-6h2x-4gjf-jc5w). The vulnerability affects versions >=0.4.0;<0.4.3 and >=0.5.0;<0.5.2, where YAML files are loaded using yaml.load() instead of the secure yaml.safe_load() function (GitHub Advisory).

The vulnerability exists within the autogluon.multimodal module's YAML file handling mechanism. The issue stems from the use of yaml.load() for deserialization instead of the safer yaml.safeload() function. This vulnerability was addressed in the codebase by replacing the unsafe load function with safeload in the predictor.py file (GitHub Commit).

The deserialization of untrusted data could potentially allow an unprivileged third party to execute remote code, cause denial of service, and impact both the confidentiality and integrity of the system (GitHub Advisory).

The vulnerability has been patched in autogluon.multimodal versions 0.4.3 and 0.5.2. Users are strongly recommended to upgrade to these patched versions. As a workaround, users should not load data from untrusted sources or data that could have been tampered with (GitHub Advisory).