MAL-2026-10531 Malicious code in chain-devkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aabf751a767ad631ac38651254930d99c8ccb0feab8dc5c96b5d3ab243796ddc The postinstall script fetches YAML from https://chain-devkit.com/config with no version pin, hash, or signature check, then parses it with js-yaml...

VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files

Summary vcrpy deserializes YAML cassette files with PyYAML's object-constructing loader yaml.CLoader / yaml.Loader instead of the safe loader yaml.CSafeLoader / yaml.SafeLoader. A cassette containing a !!python/object/apply: or similar tag therefore executes arbitrary Python code the moment the...

ROS-2-2145

2.2145 PyYAML parser vulnerability CVE-2020-14343 1. Vulnerability description: A vulnerability in the PyYAML parser, is related to insufficient validation of user input when processing unreliable YAML files using the fullload method or the FullLoader loader. Exploitation of the vulnerability...

Deserialization of Untrusted Data

Overview pyqlib is an AI-oriented quantitative investment platform. Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The workflow function in cli part of qlib was using an unsafe YAML load function. Details Serialization is a process of converting an object...

UBUNTU-CVE-2017-18342

In PyYAML before 5.1, the yaml.load API could execute arbitrary code if used with untrusted data. The load function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function...

DEBIAN-CVE-2017-18342

In PyYAML before 5.1, the yaml.load API could execute arbitrary code if used with untrusted data. The load function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function...

PYSEC-2018-49

In PyYAML before 5.1, the yaml.load API could execute arbitrary code if used with untrusted data. The load function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function...

Linaro LAVA Remote Code Execution Vulnerability

Linaro LAVA is an automated verification system. The system is primarily used to test the deployment of device systems based on ARM cores. A security vulnerability exists in Linaro LAVA versions prior to 2018.5.post1, which stems from the program using the 'yaml.load' function instead of the...