CVE-2019-25777

YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options. A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/ingydotnet/yaml-pm/commit/bace96b5e6661d521c7c515c94a09e081c911fce.patch
https://github.com/ingydotnet/yaml-pm/issues/212
https://metacpan.org/release/TINITA/YAML-1.28/changes
http://www.openwall.com/lists/oss-security/2026/10/05/7

Configurations

No configuration.

History

06 Oct 2026, 17:17

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.3

05 Oct 2026, 19:17

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2026/10/05/7 -

05 Oct 2026, 07:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-05 07:16

Updated : 2026-10-06 17:17

NVD link : CVE-2019-25777

Mitre link : CVE-2019-25777

CVE.ORG link : CVE-2019-25777

JSON object : View

Products Affected

No product.

CWE

CWE-502

Deserialization of Untrusted Data

CWE-914

Improper Control of Dynamically-Identified Variables

{"id": "CVE-2019-25777", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2019-25777", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-06T16:58:07.558999Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/ingydotnet/yaml-pm", "modules": ["YAML"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.27_001", "versionType": "custom"}], "packageURL": "pkg:cpan/YAML", "packageName": "YAML", "programFiles": ["lib/YAML/Types.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "YAML::Type::glob::yaml_load"}]}]}], "published": "2026-10-05T07:16:29.557", "references": [{"url": "https://github.com/ingydotnet/yaml-pm/commit/bace96b5e6661d521c7c515c94a09e081c911fce.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://github.com/ingydotnet/yaml-pm/issues/212", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/TINITA/YAML-1.28/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/05/7", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-502"}, {"lang": "en", "value": "CWE-914"}]}], "descriptions": [{"lang": "en", "value": "YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.\n\nA perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.\n\nA perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code."}], "lastModified": "2026-10-06T17:17:09.893", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}