Unsafe YAML deserialization in yaml.Loader in transmute-core prior to 1.13.5 allows malicious users to execute arbitrary Python code.
toumorokoshi transmute-core