CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2017-18342
Critical (9.8). EPSS 5.7% chance of exploitation in the next 30 days. Fixed in pyyaml 5.1.
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
Severity
- EPSS
- 5.7% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- pyyaml:pyyaml
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rprw-h62v-c2w7 | PyPI | pyyaml | <5.1 | 5.1 |
| PYSEC-2018-49 | PyPI | pyyaml | <5.1 | 5.1 |