ROOT-APP-NPM-CVE-2026-59869 CVE-2026-59869 in js-yaml - Patched by Root

Root has patched CVE-2026-59869 in the js-yaml package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-64718 CVE-2025-64718 in js-yaml - Patched by Root

Root has patched CVE-2025-64718 in the js-yaml package for Root:npm. Multiple fixed versions available...

CLSA-2026-1784250517 TuxCare security update for symfony/yaml (1 CVE)

TuxCare rebuilt symfony/yaml to address 1 CVE. Fixed in v3.4.47-p2+tuxcare...

CLSA-2026-1778805968 TuxCare security update for js-yaml (3 CVEs)

TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 4.1.0-tuxcare.1...

CLSA-2026-1774570935 TuxCare security update for js-yaml (3 CVEs)

TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.7.0-tuxcare.1...

CLSA-2026-1773965915 TuxCare security update for js-yaml (14 CVEs)

TuxCare rebuilt js-yaml to address 14 CVEs. Fixed in 3.3.1-tuxcare.1...

ROOT-APP-MAVEN-CVE-2022-1471 CVE-2022-1471 in io.root.org.yaml:snakeyaml - Patched by Root

Root has patched CVE-2022-1471 in the io.root.org.yaml:snakeyaml package for Root:Maven. Multiple fixed versions available...

NPM: js-yaml: YAML merge-key chains can force quadratic CPU consumption

NPM: js-yaml: YAML merge-key chains can force quadratic CPU consumption vulnerability discovered by ? in WordPress Npm js-yaml versions = 3.0.0, 3.15.0...

GHSA-724G-MXRG-4QVM js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA

Summary js-yaml v5.x introduces YAML11SCHEMA support with the !!omap ordered map tag. The omapTag.addItem function performs a linear On scan for duplicate key detection on every insertion, resulting in On^2 total time to parse a document with n omap entries. An attacker can send a small crafted...

OPENSUSE-SU-2026:11299-1 perl-YAML-Syck-1.470.0-1.1 on GA media

These are all security issues fixed in the perl-YAML-Syck-1.470.0-1.1 package on the GA media of openSUSE Tumbleweed...

Linux Distros Unpatched Vulnerability : CVE-2026-57075

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syckbase64dec. The base64 decoder in the bundled...

CVE-2026-57077

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newlinelen. In the bundled libsyck newlinelen and isnewline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-terminator or bounds check. During block-scalar...

PT-2026-60595

Name of the Vulnerable Software and Affected Versions YAML::Syck versions prior to 1.47 Description An out-of-bounds read occurs during an unbounded newline scan within the newline len function. In the bundled libsyck, the newline len and is newline functions dereference the scan pointer and the...

CVE-2026-58486 HedgeDoc: Denial-of-service via YAML alias expansion in note frontmatter

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, HedgeDoc was vulnerable to a YAML alias bomb due to unsafe processing of the note frontmatter. HedgeDoc parsed frontmatter with js-yaml.load js-yaml v3 via @hedgedoc/meta-marked, which...

PYSEC-2026-1683 MS SWIFT Remote Code Execution via unsafe PyYAML deserialization

Description A Remote Code Execution RCE vulnerability exists in the modelscope/ms-swift project due to unsafe use of yaml.load in combination with vulnerable versions of the PyYAML library ≤ 5.3.1. The issue resides in the tests/run.py script, where a user-supplied YAML configuration file is...

PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading

SummaryThe AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML files without disabling dangerous tags such as !!js/function and !!js/undefined. This allows an attacker to craft a malicious YAML file that, when parsed, executes arbitrary JavaScript code. An attacker can...

Security Bulletin: Due to use of js-yaml-4.1.0.tgz, IBM Sterling Connect:Direct Web Services is affected by modify the prototype of the result of a parsed yaml.

Summary js-yaml-4.1.0.tgz is used by IBM Sterling Connect:Direct Web Services CVE-2025-64718. Vulnerability Details CVEID:CVE-2025-64718 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the...

Astra Linux – Vulnerability in pyyaml

A vulnerability was discovered in the PyYAML library in versions prior to 5.3.1. In these versions, the library is susceptible to arbitrary code execution when it processes untrusted YAML files using the fullload method or the FullLoader loader. Applications that use this library to process...

Astra Linux – Vulnerability in yaml-cpp

The SingleDocParser::HandleFlowMap function in yaml-cpp also known as LibYaml-C++ 0.6.2 allows remote attackers to cause a denial of service resource consumption and application crash through a crafted YAML file...

Astra Linux – Vulnerability in yaml-cpp

The Scanner::EnsureTokensInQueue function in yaml-cpp also known as LibYaml-C++ 0.6.2 allows remote attackers to cause a denial of service stack consumption and application crash through a crafted YAML file...