Two Perl YAML flaws cover variable overwrite and DESTROY
Stig Palmquist disclosed two Perl YAML bugs: before 1.27_001 package variables can be overwritten, and before 1.30 DESTROY can run on arbitrary classes.
On 5 October 2026, oss-security posts from Stig Palmquist described two vulnerabilities in the Perl YAML module, tracked on CPAN and GitHub as yaml-pm. CVE-2019-25777 affects versions before 1.27_001: loading a perl/glob document can replace any package variable, which the advisory says can lead to arbitrary code execution. CVE-2017-20285 affects versions before 1.30 and lets a loaded YAML document trigger the DESTROY method of arbitrary classes. Neither notice says the flaws are being exploited. The reports do not conflict; they cover different CVEs, version cutoffs, and mechanisms in the same module.
- CVE-2019-25777 affects Perl YAML versions before 1.27_001.
- Loading a perl/glob document can replace any package variable and, per the advisory, can lead to arbitrary code execution.
- CVE-2017-20285 affects Perl YAML versions before 1.30, tracked on CPAN and GitHub as yaml-pm.
- A loaded YAML document can trigger the DESTROY method of arbitrary classes.
- Both issues were reported by Stig Palmquist in oss-security posts on 2026-10-05.
- Neither post reports observed or active exploitation.
Coverage timelineoldest first · each row is one article
- · 11d agoCVE-2019-25777: YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution
oss-security· 48
Perl YAML before 1.27_001 can overwrite package variables and enable code execution.
- · 11d agoCVE-2017-20285: YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes
Perl YAML before 1.30 lets a loaded document invoke DESTROY on arbitrary classes.
Vulnerabilities in this storyAll →
- CVE-2017-202859.1—Unsafe deserialization in Perl YAML before 1.30published · Ingy döt Net YAML+1 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
CVE-2017-20285+1 related CVE | Unsafe deserialization in Perl YAML before 1.30 Perl YAML before 1.30 unsafely deserializes a document that uses a perl/hash:Class tag to bless a hash into a class named by the document. The document supplies the object's fields, and when the object later goes out of scope Perl calls that class's DESTROY method. What DESTROY does depends on classes already loaded in the process; with core File::Temp::Dir, the document can delete a directory tree it names. Any application that loads untrusted YAML with an affected YAML.pm is exposed to this object-injection behavior. No public proof-of-concept is known, the issue is not in CISA KEV, and in-the-wild exploitation has not been reported. |