PyYAML is a widely embedded YAML parsing library that, despite a narrow product footprint, sits deep in the Python software supply chain and propagates through countless downstream applications and frameworks. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes and concentrate in its core parsing logic around improper input validation, deserialization of untrusted data, and memory-buffer boundary violations—weakness classes inherent to unsafe unmarshaling of untrusted serialized formats. Defenders should prioritize PyYAML updates across their Python ecosystems rather than tracking the library alone, since a single flaw can affect every application that deserializes YAML input; current exploitation activity and severity distribution are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Pyyaml over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-14343CRITICAL A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the | Feb 9, 2021 | 9.8 | 34 | NO | NO |
CVE-2017-18342CRITICAL In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' ha | Jun 27, 2018 | 9.8 | 33 | NO | NO |
CVE-2020-1747CRITICAL A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through th | Mar 24, 2020 | 9.8 | 32 | NO | NO |
CVE-2019-20477CRITICAL PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. | Feb 19, 2020 | 9.8 | 32 | NO | NO |
CVE-2013-6393MEDIUM The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash | Feb 6, 2014 | 6.8 | 27 | NO | NO |
CVE-2014-2525MEDIUM Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of | Mar 28, 2014 | 6.8 | 23 | NO | NO |
CVE-2014-9130MEDIUM scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allows context-dependent attackers to cause a denial of service (assertion failure | Dec 8, 2014 | 5.0 | 19 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Pyyaml.
Media articles that mention a CVE ID that affects a product developed by Pyyaml — matched by CVE ID, not by vendor name.