{"action":"Upgrade yaml to 1.10.3 or later.","affected":[{"fixed":"2.8.3","introduced":"2.0.0"},{"fixed":"1.10.3","introduced":"1.0.0"}],"component":"yaml","cve_ids":["CVE-2026-33532"],"ecosystem":"npm","epss":0.00488,"exploited":false,"fixed_versions":["2.8.3","1.10.3"],"ghsa_id":"GHSA-48c2-rrv3-qjmp","id":"tcs_01M5KEZRZKYY87EAK096TH6017","modified_at":"2026-09-10T03:50:37.151581408Z","published_at":"2026-03-25T20:08:24Z","references":["https://osv.dev/vulnerability/GHSA-48c2-rrv3-qjmp","https://github.com/eemeli/yaml/security/advisories/GHSA-48c2-rrv3-qjmp","https://nvd.nist.gov/vuln/detail/CVE-2026-33532","https://github.com/eemeli/yaml/commit/1e84ebbea7ec35011a4c61bbb820a529ee4f359b","https://github.com/eemeli/yaml","https://github.com/eemeli/yaml/releases/tag/v1.10.3","https://github.com/eemeli/yaml/releases/tag/v2.8.3"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-48c2-rrv3-qjmp","url":"https://osv.dev/vulnerability/GHSA-48c2-rrv3-qjmp"}],"summary":"yaml is vulnerable to Stack Overflow via deeply nested YAML collections"}