{"action":"Upgrade pyyaml to 5.1 or later.","affected":[{"fixed":"5.1","introduced":"0"}],"component":"pyyaml","cve_ids":["CVE-2017-18342"],"ecosystem":"PyPI","epss":0.0557,"exploited":false,"fixed_versions":["5.1"],"ghsa_id":"GHSA-rprw-h62v-c2w7","id":"tcs_01M5KFYDCHCXZ3SY5N072NVG5G","modified_at":"2026-07-01T17:45:34.796248930Z","published_at":"2019-01-04T17:45:26Z","references":["https://osv.dev/vulnerability/GHSA-rprw-h62v-c2w7","https://nvd.nist.gov/vuln/detail/CVE-2017-18342","https://github.com/marshmallow-code/apispec/issues/278","https://github.com/yaml/pyyaml/issues/193","https://github.com/yaml/pyyaml/issues/207#issuecomment-472520007","https://github.com/yaml/pyyaml/pull/74","https://github.com/yaml/pyyaml/commit/7b68405c81db889f83c32846462b238ccae5be80","https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2018-49.yaml","https://github.com/yaml/pyyaml","https://github.com/yaml/pyyaml/blob/master/CHANGES","https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA","https://security.gentoo.org/glsa/202003-45"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-rprw-h62v-c2w7","url":"https://osv.dev/vulnerability/GHSA-rprw-h62v-c2w7"}],"summary":"PyYAML insecurely deserializes YAML strings leading to arbitrary code execution"}