Views
No views yet
exec() in Extension.buildChildren()nyoka v5.5.0 (latest) passes XML text content directly to Python's exec() without sanitization.nyoka/PMML44Super.py lines 7840-7844malicious_rce.pmml — Crafted PMML file with exec() payloadexploit_rce.py — Exploitation script1pip install nyoka==5.5.0
2python exploit_rce.py[*] Parsing malicious PMML via nyoka...
[VULNERABLE] RCE confirmed! Proof: 'PWNED_BY_PMML'