Back
CVE-2020-1747
CRITICAL
A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.
Published: Mar 24, 2020
Modified: Jun 17, 2026
CWE-20
CWE-20
CVSS Metrics
CVSSv3
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products (7)
| Vendor | Product | Version |
|---|---|---|
| pyyaml | pyyaml | * ≥ 5.1 < 5.3.1 |
| fedoraproject | fedora | 30 |
| fedoraproject | fedora | 31 |
| fedoraproject | fedora | 32 |
| fedoraproject | fedora | 33 |
| opensuse | leap | 15.1 |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | 22.1.0 |
GitHub Security Advisory GHSA-6757-jp84-gxfx
Improper Input Validation in PyYAML
pip
pyyaml
>= 5.1b7, < 5.3.1
Fixed: 5.3.1
References (20)
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00017.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00017.html Mailing List, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1747 Issue Tracking, Patch, Third Party Advisory
- https://github.com/yaml/pyyaml/pull/386 Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7PPAS6C4SZRDQLR7C22A5U3QOLXY33JX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K5HEPD7LEVDPCITY5IMDYWXUMX37VFMY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MMQXSZXNJT6ERABJZAAICI3DQSQLCP3D/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WORRFHPQVAFKKXXWLSSW6XKUYLWM6CSH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBJA3SGNJKCAYPSHOHWY3KBCWNM5NYK2/
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00017.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00017.html Mailing List, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1747 Issue Tracking, Patch, Third Party Advisory
- https://github.com/yaml/pyyaml/pull/386 Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7PPAS6C4SZRDQLR7C22A5U3QOLXY33JX/
Risk Scores
CVSS Score
9.8 / 10
EPSS Score
5.44%
Top 8% most likely to be exploited
Threat Score
40.8 / 100
Data Sources
NVD
EPSS
GitHub