CRITICAL 9.8 Microsoft
CVE-2020-1747
A vulnerability was discovered in the PyYAML library in versions before 5.3.1 where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.
Microsoft Security Update 2020-Mar: A vulnerability was discovered in the PyYAML library in versions before 5.3.1 where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.
Affected Products
- cbl2 PyYAML 5.4.1-1 on CBL Mariner 2.0
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1747
- https://nvd.nist.gov/vuln/detail/CVE-2020-1747
This critical severity vulnerability with a CVSS score of 9.8 was published on 2020-03-10 via Microsoft. EPSS score: 5.4% (top 7% of all CVEs by exploitation probability). Affected: cbl2 PyYAML 5.4.1-1 on CBL Mariner 2.0.
Risk Timeline
CVE Disclosed2020-03-10 · 2418 days ago
Remediation Resources
Official Advisory
msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1747NVD / MITRE
nvd.nist.gov/vuln/detail/CVE-2020-1747Related Vulnerabilities
| CVE | Title | Severity | CVSS |
|---|---|---|---|
| CVE-2017-20230 | Storable versions before 3.05 for Perl has a stack overflow | CRITICAL | 10.0 |
| CVE-2025-49844 PoC | Redis Lua Use-After-Free may lead to remote code execution | CRITICAL | 9.9 |
| CVE-2024-41110 PoC | Moby authz zero length regression | CRITICAL | 9.9 |
| CVE-2026-3381 | Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure ver | CRITICAL | 9.8 |
| CVE-2026-4176 | Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from | CRITICAL | 9.8 |
| CVE-2026-33937 | Handlebars.js has JavaScript Injection via AST Type Confusion | CRITICAL | 9.8 |
vulnfeed aggregates 15883 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.