GitHub Advisoryadvisory · PyPI

GHSA-rprw-h62v-c2w7 PyYAML insecurely deserializes YAML strings leading to arbitrary code execution

CRITICAL Published 2019-01-04 Modified 2026-07-01 Official page ↗
Aliases
CVE-2017-18342
Ecosystem
PyPI
Packages
PyYAML
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2020-06-16

Affected packages

• PyPI PyYAML: < 5.1 → fixed in 5.1

Description

In PyYAML before 5.1, the `yaml.load()` API could execute arbitrary code. In other words, `yaml.safe_load` is not used. This was intended to be fixed in 4.1, but due to breaking changes, 4.1 was yanked and 5.1 contains the patch for CVE-2017-18342.

Related

Alias · CVE (1)

  • CVE-2017-18342 In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References