CVE-2019-25777: YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution

Perl YAML before 1.27_001 lets a loaded perl/glob document overwrite any package variable, including loader options that are off by default. An attacker who can supply two documents to separate Load calls in the same process can turn on code loading and then have a perl/code document passed to a string eval. That results in arbitrary Perl code execution in the application process. Any software that parses untrusted YAML with an affected YAML.pm is at risk. No public proof of concept is known, the issue is not on the CISA KEV list, and exploitation in the wild is not reported.

Do: Upgrade the Perl YAML module to 1.27_001 or later. Until then, do not pass untrusted documents to YAML Load, especially across more than one Load call in the same process, and review any application that deserializes external YAML with this module.