Skip to content
OpenAdvisories
Critical USN-4940-1 1 CVE

pyyaml vulnerability

Published May 10, 2021 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that PyYAML incorrectly handled untrusted YAML files with
the FullLoader loader. A remote attacker could possibly use this issue to
execute arbitrary code.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS pyyaml 5.3.1-1ubuntu0.1

Vulnerabilities 1

  • Critical 9.8
    CVE-2020-14343 Public exploit

    Improper Input Validation in PyYAML

    A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the libra…

    pyyaml pyyaml pyyaml PyYAML Debian Ubuntu Azure Linux Alpine PyPI

References

  • report
    https://ubuntu.com/security/CVE-2020-14343