CyberSecBulletin

SnakeYAML vulnerabilities

We track 1 vulnerability in SnakeYAML products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on December 1, 2022.

1vulnerabilities
1critical
0high
0exploited
9.8average CVSS score

Latest SnakeYAML vulnerabilities

  • 9.8 Critical severity

    SnakeYAML: Deserialization of Untrusted Data

    CVE-2022-1471SnakeYAMLEPSS 99.5%

    SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untruste