A vulnerability was discovered in the PyYAML library in versions before 5.3.1 where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.

🗓️ 07 Nov 2023 08:00:00Reported by MicrosoftType

PyYAML vulnerability before 5.3.1 enables arbitrary code execution via full_load or FullLoader on untrusted YAML input.

Reporter	Title	Published	Views	Family All 147
ALT Linux	Security fix for the ALT Linux 9 package python-module-yaml version 5.4.1-alt0.p9	22 Mar 202100:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Critical Vulnerabilities in libraries used by libraries that IBM Spectrum discover is using (libraries of libraries)	28 Mar 202216:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	12 Jan 202317:19	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in PyYAML affects IBM Spectrum Protect Plus Container and Microsoft File Systems Agents (CVE-2020-1747)	4 Dec 202006:02	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	18 Aug 202504:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	9 Oct 202020:01	–	ibm
GithubExploit	Exploit for Deserialization of Untrusted Data in Pyyaml	29 Aug 202510:27	–	githubexploit
FreeBSD	py-yaml -- FullLoader (still) exploitable for arbitrary command execution	2 Mar 202000:00	–	freebsd
ATTACKERKB	CVE-2020-14343	9 Feb 202100:00	–	attackerkb
Tenable Nessus	Alibaba Cloud Linux 3 : 0269: PyYAML (ALINUX3-SA-2024:0269)	14 May 202500:00	–	nessus