CVE-2017-18342

—

CVSS 3.1

9.8 critical

EPSS

6%p93

Published

Jun 27, 2018 (Jun 27, 2018)

Modified

Jun 17, 2026

Description

In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.

Vendors: pyyaml fedoraproject
Products: pyyaml, fedora
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (5.7%)

In the news0 stories

No ingested article mentions this CVE yet.