CVE-2021-38305

CVE-2021-38305 is a critical vulnerability affecting 23andMe Yamale versions prior to 3.0.8, allowing remote attackers to execute arbitrary code through specially crafted schema files. The vulnerability stems from the schema parser's use of Python's eval function, which, despite attempts to limit builtins, can be manipulated with a well-constructed string to execute system commands. This flaw carries a high CVSS score of 7.8, indicating a significant risk of complete compromise (confidentiality, integrity, and availability) if an attacker can trick a user into processing a malicious schema. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.