CVE-2019-25777

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2019-25777", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-09-21T21:17:21.642Z", "datePublished": "2026-10-05T06:50:17.532Z", "dateUpdated": "2026-10-06T16:58:19.261Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["YAML"], "packageName": "YAML", "packageURL": "pkg:cpan/YAML", "programFiles": ["lib/YAML/Types.pm"], "programRoutines": [{"name": "YAML::Type::glob::yaml_load"}], "repo": "https://github.com/ingydotnet/yaml-pm", "versions": [{"lessThan": "1.27_001", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.\n\nA perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.\n\nA perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-914", "description": "CWE-914 Improper Control of Dynamically-Identified Variables", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-05T06:50:17.532Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://github.com/ingydotnet/yaml-pm/issues/212"}, {"tags": ["patch"], "url": "https://github.com/ingydotnet/yaml-pm/commit/bace96b5e6661d521c7c515c94a09e081c911fce.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/TINITA/YAML-1.28/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to YAML 1.28 or later."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2019-04-27T00:00:00.000Z", "value": "Issue reported."}, {"lang": "en", "time": "2019-04-27T00:00:00.000Z", "value": "Version 1.27_001 released with fix."}, {"lang": "en", "time": "2019-04-28T00:00:00.000Z", "value": "Version 1.28 released with fix."}, {"lang": "en", "time": "2022-06-27T00:00:00.000Z", "value": "Issue added as CPANSA-YAML-2019-01 in the CPAN::Audit database."}, {"lang": "en", "time": "2026-09-21T00:00:00.000Z", "value": "CVE number reserved."}], "title": "YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution", "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade to YAML 1.28, set $YAML::LoadBlessed = 0 before loading untrusted input. The option exists from YAML 1.25 and gates glob loading too."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/05/7"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-05T18:10:19.164Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-06T16:58:07.558999Z", "id": "CVE-2019-25777", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T16:58:19.261Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2019-25777", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-06T16:58:07.558999Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-06T16:58:01.220Z"}}], "cna": {"title": "YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/ingydotnet/yaml-pm", "modules": ["YAML"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.27_001", "versionType": "custom"}], "packageURL": "pkg:cpan/YAML", "packageName": "YAML", "programFiles": ["lib/YAML/Types.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "YAML::Type::glob::yaml_load"}]}], "timeline": [{"lang": "en", "time": "2019-04-27T00:00:00.000Z", "value": "Issue reported."}, {"lang": "en", "time": "2019-04-27T00:00:00.000Z", "value": "Version 1.27_001 released with fix."}, {"lang": "en", "time": "2019-04-28T00:00:00.000Z", "value": "Version 1.28 released with fix."}, {"lang": "en", "time": "2022-06-27T00:00:00.000Z", "value": "Issue added as CPANSA-YAML-2019-01 in the CPAN::Audit database."}, {"lang": "en", "time": "2026-09-21T00:00:00.000Z", "value": "CVE number reserved."}], "solutions": [{"lang": "en", "value": "Upgrade to YAML 1.28 or later."}], "references": [{"url": "https://github.com/ingydotnet/yaml-pm/issues/212", "tags": ["issue-tracking"]}, {"url": "https://github.com/ingydotnet/yaml-pm/commit/bace96b5e6661d521c7c515c94a09e081c911fce.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/TINITA/YAML-1.28/changes", "tags": ["release-notes"]}], "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade to YAML 1.28, set $YAML::LoadBlessed = 0 before loading untrusted input. The option exists from YAML 1.25 and gates glob loading too."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.\n\nA perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.\n\nA perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-914", "description": "CWE-914 Improper Control of Dynamically-Identified Variables"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-05T06:50:17.532Z"}}}, "cveMetadata": {"cveId": "CVE-2019-25777", "state": "PUBLISHED", "dateUpdated": "2026-10-05T18:10:19.164Z", "dateReserved": "2026-09-21T21:17:21.642Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-10-05T06:50:17.532Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["YAML"], "packageName": "YAML", "packageURL": "pkg:cpan/YAML", "programFiles": ["lib/YAML/Types.pm"], "programRoutines": [{"name": "YAML::Type::glob::yaml_load"}], "repo": "https://github.com/ingydotnet/yaml-pm", "versions": [{"lessThan": "1.27_001", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.\n\nA perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.\n\nA perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code."}], "id": "CVE-2019-25777", "lastModified": "2026-10-06T17:17:09.893", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2019-25777", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-06T16:58:07.558999Z", "version": "2.0.3"}}]}, "published": "2026-10-05T07:16:29.557", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/ingydotnet/yaml-pm/commit/bace96b5e6661d521c7c515c94a09e081c911fce.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/ingydotnet/yaml-pm/issues/212"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/TINITA/YAML-1.28/changes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/05/7"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}, {"lang": "en", "value": "CWE-914"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-yaml: perl-yaml: Arbitrary code execution via unrestricted package variable assignment", "id": "2545818", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545818"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-502", "details": ["A flaw was found in perl-yaml. This vulnerability can lead to arbitrary code execution because the parser fails to restrict package variable modifications specified in YAML documents. An attacker capable of submitting crafted YAML input can overwrite internal configuration settings to enable code loading, allowing them to execute arbitrary Perl code within the running process."], "name": "CVE-2019-25777", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "perl-YAML", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "perl-YAML", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "perl-YAML", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "perl-YAML:1.24/perl-YAML", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "perl-YAML", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-05T06:50:17Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2019-25777\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-25777\nhttps://github.com/ingydotnet/yaml-pm/commit/bace96b5e6661d521c7c515c94a09e081c911fce.patch\nhttps://github.com/ingydotnet/yaml-pm/issues/212\nhttps://metacpan.org/release/TINITA/YAML-1.28/changes"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.27_001)"}}], "enrichment": {"confidence": 75.0, "confidence_source": "inferred", "scores": [{"score": 75.0, "source": "inferred"}]}, "product": "yaml", "vendor": "ingydotnet"}], "created": "2026-10-05T09:30:10.642122+00:00", "updated": "2026-10-07T07:15:08.633285+00:00", "vendors": ["ingydotnet", "ingydotnet$PRODUCT$yaml"]}