CVE-2020-1747

🗓️ 24 Mar 2020 13:56:37Reported by redhatType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 446 Views🌐 WEB

Vulnerability in PyYAML library allows arbitrary code execution via untrusted YAML files

Reporter	Title	Published	Views	Family All 149
ALT Linux	Security fix for the ALT Linux 9 package python-module-yaml version 5.4.1-alt0.p9	22 Mar 202100:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Critical Vulnerabilities in libraries used by libraries that IBM Spectrum discover is using (libraries of libraries)	28 Mar 202216:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	12 Jan 202317:19	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in PyYAML affects IBM Spectrum Protect Plus Container and Microsoft File Systems Agents (CVE-2020-1747)	4 Dec 202006:02	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	18 Aug 202504:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	9 Oct 202020:01	–	ibm
GithubExploit	Exploit for Deserialization of Untrusted Data in Pyyaml	29 Aug 202510:27	–	githubexploit
FreeBSD	py-yaml -- FullLoader (still) exploitable for arbitrary command execution	2 Mar 202000:00	–	freebsd
FreeBSD	PyYAML -- arbitrary code execution	22 Jul 202000:00	–	freebsd
ATTACKERKB	CVE-2020-14343	9 Feb 202100:00	–	attackerkb

NVD

Vulners

Node

pyyaml pyyamlRange5.1–5.3.1

Node

fedoraproject fedoraMatch30

fedoraproject fedoraMatch31

fedoraproject fedoraMatch32

fedoraproject fedoraMatch33

Node

opensuse leapMatch15.1

Node

oracle communications_cloud_native_core_network_function_cloud_native_environmentMatch22.1.0

[
  {
    "product": "PyYAML",
    "vendor": "Red Hat",
    "versions": [
      {
        "status": "affected",
        "version": "5.3.1"
      }
    ]
  }
]

Source	Link
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WORRFHPQVAFKKXXWLSSW6XKUYLWM6CSH/
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
oracle	www.oracle.com/security-alerts/cpujul2022.html
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MMQXSZXNJT6ERABJZAAICI3DQSQLCP3D/
github	www.github.com/yaml/pyyaml/pull/386
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBJA3SGNJKCAYPSHOHWY3KBCWNM5NYK2/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K5HEPD7LEVDPCITY5IMDYWXUMX37VFMY/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7PPAS6C4SZRDQLR7C22A5U3QOLXY33JX/
lists	www.lists.opensuse.org/opensuse-security-announce/2020-05/msg00017.html
lists	www.lists.opensuse.org/opensuse-security-announce/2020-04/msg00017.html

Parameter	Position	Path	Description	CWE
q	query param	/search	Reflected XSS vulnerability in search endpoint using user-controlled query parameter	CWE-20
host	query param	/ping	Command injection possibility via ping endpoint using user-controlled host parameter	CWE-20
filename	query param	/file	Path traversal risk in file endpoint through unvalidated filename parameter	CWE-20

17 Jun 2026 03:02Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8

CVSS 210

EPSS0.05299

CWE-20