$ cve CVE-2020-1747 JSON

CVE-2020-1747

9.8

CRITICAL · CVSS 3.1 · EPSS 5.4% (pctl 93)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	5.44% — more likely to be exploited than 93% of all CVEs
Weakness	CWE-20
On CISA KEV	no
Public exploit	none known
Published	2020-03-24
Last modified	2026-06-17

Affected (4)

Vendor	Product
fedoraproject	fedora
opensuse	leap
oracle	communications cloud native core network function cloud native environment
pyyaml	pyyaml

References

→ the Explorer · watch your stack · NVD