CVE-2020-14343

🗓️ 09 Feb 2021 00:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 1309 Views🌐 WEB

Vulnerability in PyYAML library allows arbitrary code execution via untrusted YAML files in versions < 5.

Reporter	Title	Published	Views	Family All 293
IBM Security Bulletins	Security Bulletin: IBM Storage Defender - Data Protect critical vulnerabilities resolved in Release Defender 2.2.1/Data Protect 7.4.1	17 Aug 202616:05	–	ibm
IBM Security Bulletins	Security Bulletin: Critical Vulnerabilities in libraries used by libraries that IBM Spectrum discover is using (libraries of libraries)	28 Mar 202216:33	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in PyYAML affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) [CVE-2020-14343]	11 Mar 202412:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.6.4 fixes multiple security vulnerabilities	15 Dec 202314:31	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	18 Aug 202504:31	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security contains packages that have multiple vulnerabilities	1 Apr 202216:38	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in PyYAML affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2020-14343]	26 Apr 202520:00	–	ibm
GithubExploit	Exploit for Improper Input Validation in Pyyaml	19 Sep 202620:55	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Pyyaml	13 Jul 202616:53	–	githubexploit
attackerkb	CVE-2026-24009	22 Jan 202615:04	–	attackerkb

NVD

Vulners

Node

pyyaml pyyamlRange5.1–5.4

Node

oracle communications_cloud_native_core_network_function_cloud_native_environmentMatch1.10.0

oracle communications_cloud_native_core_network_function_cloud_native_environmentMatch22.1.0

[
  {
    "vendor": "n/a",
    "product": "PyYAML",
    "versions": [
      {
        "version": "PyYAML 5.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
oracle	www.oracle.com/security-alerts/cpuapr2022.html
github	www.github.com/yaml/pyyaml/issues/420
github	www.github.com/SeldonIO/seldon-core/issues/2252
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
oracle	www.oracle.com/security-alerts/cpujul2022.html

Parameter	Position	Path	Description	CWE
YAML input	request body	/parse	The /parse endpoint accepts YAML input and processes it using PyYAML's FullLoader, which is vulnerable to arbitrary code execution via specially crafted YAML tags (e.g., !!python/object/new).	CWE-20
name	request body	/	The root endpoint takes a 'name' parameter and parses it through PyYAML's default loader (FullLoader), allowing for arbitrary code execution via malicious YAML payloads.	CWE-20

17 Jun 2026 02:54Current

8.1High risk

Vulners AI Score8.1

CVSS 3.19.8

CVSS 210

EPSS0.0624

CWE-20