{"cve":"CVE-2022-31691","nvd":{"published":"2022-11-04T19:15:10.910","modified":"2026-06-17T04:46:05.283","status":"Modified","description":"Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML that under certain circumstances allows for potentially harmful remote code execution by the attacker.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-94"],"references":["https://tanzu.vmware.com/security/cve-2022-31691","https://tanzu.vmware.com/security/cve-2022-31691"],"products":["vmware:bosh_editor","vmware:cloudfoundry_manifest_yml_support","vmware:concourse_ci_pipeline_editor","vmware:spring_boot_tools","vmware:spring_tools"],"source":"nvd","synced_at":"2026-10-19T21:37:08.729216836+00:00"},"epss":{"cve":"CVE-2022-31691","score":0.03432,"percentile":0.88949,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}