AI analysis
Perl YAML before 1.27_001 lets a loaded perl/glob document overwrite any package variable, including loader options that are off by default. An attacker who can supply two documents to separate Load calls in the same process can turn on code loading and then have a perl/code document passed to a string eval. That results in arbitrary Perl code execution in the application process. Any software that parses untrusted YAML with an affected YAML.pm is at risk. No public proof of concept is known, the issue is not on the CISA KEV list, and exploitation in the wild is not reported.
What to do: Upgrade the Perl YAML module to 1.27_001 or later. Until then, do not pass untrusted documents to YAML Load, especially across more than one Load call in the same process, and review any application that deserializes external YAML with this module.
Affected
| Ingy döt Net YAML | before 1.27_001 |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options. A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.