Improper Input Validation in PyYAML
Critical severity
GitHub Reviewed
Published
Mar 25, 2021
to the GitHub Advisory Database
•
Updated Aug 23, 2023
Description
Published by the National Vulnerability Database
Feb 9, 2021
Reviewed
Mar 25, 2021
Published to the GitHub Advisory Database
Mar 25, 2021
Last updated
Aug 23, 2023
A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.
References