Skip to content

Improper Input Validation in PyYAML

Critical severity GitHub Reviewed Published Apr 20, 2021 to the GitHub Advisory Database • Updated Aug 25, 2023

Package

pip pyyaml (pip)

Affected versions

< 5.3.1

Patched versions

5.3.1

Description

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.

References

Published by the National Vulnerability Database Mar 24, 2020
Reviewed Apr 7, 2021
Published to the GitHub Advisory Database Apr 20, 2021
Last updated Aug 25, 2023

Severity

Critical
9.8
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CVE ID

CVE-2020-1747

GHSA ID

GHSA-6757-jp84-gxfx

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.