Affected: YAML

YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.

A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.

A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.

Affected: Ubuntu:Pro:16.04:LTS: libyaml-perl, Ubuntu:Pro:18.04:LTS: libyaml-perl, Ubuntu:Pro:20.04:LTS: libyaml-perl, Ubuntu:22.04:LTS: libyaml-perl, Ubuntu:24.04:LTS: libyaml-perl, Ubuntu:Pro:26.04:LTS: libyaml-perl

Dominique Dumont discovered that YAML-LibYAML did not correctly handle certain reflection operations. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to delete files. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2017-20285)

It was discovered that YAML-LibYAML did not correctly handle parsing certain documents. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-25777)

It was discovered that YAML-LibYAML contained a regular expression susceptible to catastrophic backtracking. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. (CVE-2026-63676)