Read the docs
TI-2023-25526 Aliases CVE-2023-47204GHSA-w9cp-3x79-2p8p

Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows…

Priority MEDIUM 51CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00951 61st percentileScored 2026-11-07
Fix Fixed transmute-core (PyPI): 1.13.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—transmute-core (PyPI)before 1.13.51.13.5Patch availableGHSA-w9cp-3x79-2p8p
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • transmute-core (PyPI) Vendor— Affected before 1.13.5 Fixed in 1.13.5 Patch available GHSA-w9cp-3x79-2p8p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:toumorokoshi:transmute-core:*:*:*:*:*:*:*:*before 1.13.5VulnerableToumorokoshi
  • cpe:2.3:a:toumorokoshi:transmute-core:*:*:*:*:*:*:*:* Versions before 1.13.5 Vulnerable ·Toumorokoshi

Remediation

  • Fix · GHSA-w9cp-3x79-2p8p transmute-core (PyPI) Fixed in 1.13.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-47204
  2. 2026-10-03 Alias added: GHSA-w9cp-3x79-2p8p

References

Patch 1

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences