PyYAML insecurely deserializes YAML strings leading to arbitrary code execution
Critical severity
GitHub Reviewed
Published
Jan 4, 2019
to the GitHub Advisory Database
•
Updated Sep 5, 2023
Description
Published to the GitHub Advisory Database
Jan 4, 2019
Reviewed
Jun 16, 2020
Last updated
Sep 5, 2023
In PyYAML before 4.1, the
yaml.load()
API could execute arbitrary code. In other words,yaml.safe_load
is not used.References