{"action":"Upgrade org.yaml:snakeyaml to 2.0 or later.","affected":[{"fixed":"2.0","introduced":"0"}],"component":"org.yaml:snakeyaml","cve_ids":["CVE-2022-1471"],"ecosystem":"Maven","epss":0.99501,"exploited":false,"fixed_versions":["2.0"],"ghsa_id":"GHSA-mjmj-j48q-9wg2","id":"tcs_01M5N959YBAFCG95PMRHYSXYT2","modified_at":"2026-09-10T03:49:50.365884036Z","published_at":"2022-12-12T21:19:47Z","references":["https://osv.dev/vulnerability/GHSA-mjmj-j48q-9wg2","https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2","https://nvd.nist.gov/vuln/detail/CVE-2022-1471","https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true","https://snyk.io/blog/unsafe-deserialization-snakeyaml-java-cve-2022-1471","https://security.netapp.com/advisory/ntap-20240621-0006","https://security.netapp.com/advisory/ntap-20230818-0015","https://infosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4c","https://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnc","https://github.com/mbechler/marshalsec","https://confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-products-1296171009.html","https://bitbucket.org/snakeyaml/snakeyaml/wiki/CVE-2022-1471","https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64876314","https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64634374","https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479","https://bitbucket.org/snakeyaml/snakeyaml/commits/acc44099f5f4af26ff86b4e4e4cc1c874e2dc5c4","https://bitbucket.org/snakeyaml/snakeyaml/commits/5014df1a36f50aca54405bb8433bc99a8847f758","https://bitbucket.org/snakeyaml/snakeyaml","http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html","http://www.openwall.com/lists/oss-security/2023/11/19/1"],"severity":{"label":"high","score":8.3},"sources":[{"source":"osv","source_id":"GHSA-mjmj-j48q-9wg2","url":"https://osv.dev/vulnerability/GHSA-mjmj-j48q-9wg2"}],"summary":"SnakeYaml Constructor Deserialization Remote Code Execution"}