CVE-2019-25777
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
YAML before version 1.27_001 for Perl allows a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. The document can enable code loading options that are off by default.
Risk Assessment
An attacker can execute arbitrary Perl code in the process, potentially leading to full system compromise or data integrity violation.
Recommendation
Update YAML to version 1.27_001 or later and avoid loading untrusted YAML documents.
Other vulnerabilities in YAML
See all- CVE-2026-33532Medium
In the yaml library on the 1.x branch before 1.10.3 or the 2.x branch before 2.8.3, parsing a YAML document may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a RangeError: Maximum call stack size exceeded with a small payload (~2–10 KB). The RangeError is not a YAMLParseError, so applications that only catch YAML-specific errors will encounter an unexpected exception type, which depending on the host application's exception handling can fail requests or terminate the Node.js process.
- CVE-2017-20285Critical
YAML before version 1.30 for Perl allows a loaded document to trigger the DESTROY method of arbitrary classes. The perl/hash:Class tag blesses a hash into the class it names, and Perl calls DESTROY when it goes out of scope.
Original NVD description (English source)
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options. A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS