<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>RCE on Arjun&#39;s Blog</title>
    <link>/tags/rce/</link>
    <description>Recent content in RCE on Arjun&#39;s Blog</description>
    <generator>Hugo</generator>
    <language>en</language>
    <lastBuildDate>Wed, 03 Dec 2025 00:00:00 +0000</lastBuildDate>
    <atom:link href="/tags/rce/index.xml" rel="self" type="application/rss+xml" />
    <item>
      <title>TensorFlow CVE-2021-37678 – YAML Deserialization RCE</title>
      <link>/posts/5-tensorflow-cve-2021-37678-rce/</link>
      <pubDate>Wed, 03 Dec 2025 00:00:00 +0000</pubDate>
      <guid>/posts/5-tensorflow-cve-2021-37678-rce/</guid>
      <description>&lt;p&gt;Back in my college days, I was heavily into security research and playing CTFs. One of the bigger things I stumbled on was an &lt;strong&gt;RCE vulnerability in Google&amp;rsquo;s TensorFlow/Keras&lt;/strong&gt; that eventually became &lt;strong&gt;CVE-2021-37678&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;This post is basically a write-up of that journey, mostly for documenting what I did and partly to revive my security brain after being a Software Engineer for about 3.5 years.&lt;/p&gt;&#xA;&lt;p&gt;If you&amp;rsquo;re into Machine Learning, Python internals, or want to see how something seemingly harmless like YAML can blow up into Remote Code Execution — this one’s for you.&lt;/p&gt;</description>
    </item>
  </channel>
</rss>
