CVE-2020-1747 — Improper Input Validation in Pyyaml
Severity
9.8CRITICALNVD
EPSS
3.1%
top 13.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 24
Latest updateSep 3
Description
A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages11 packages
Also affects: Fedora 30, 31, 32, 33
Patches
🔴Vulnerability Details
7📋Vendor Advisories
6Microsoft▶
A vulnerability was discovered in the PyYAML library in versions before 5.4 where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or w↗2021-02-09
Microsoft▶
A vulnerability was discovered in the PyYAML library in versions before 5.3.1 where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or↗2020-03-10
Red Hat
▶
Debian▶
CVE-2020-1747: pyyaml - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, w...↗2020
🕵️Threat Intelligence
1📄Research Papers
1arXiv▶
VulnRepairEval: An Exploit-Based Evaluation Framework for Assessing Large Language Model Vulnerability Repair Capabilities↗2025-09-03
💬Community
6Bugzilla
▶
Bugzilla
▶
Bugzilla▶
CVE-2020-1747 PyYAML: arbitrary command execution through python/object/new when FullLoader is used [fedora-all]↗2020-03-02