{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2019-25777", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-09-21T21:17:21.642Z", "datePublished": "2026-10-05T06:50:17.532Z", "dateUpdated": "2026-10-05T06:50:17.532Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["YAML"], "packageName": "YAML", "packageURL": "pkg:cpan/YAML", "programFiles": ["lib/YAML/Types.pm"], "programRoutines": [{"name": "YAML::Type::glob::yaml_load"}], "repo": "https://github.com/ingydotnet/yaml-pm", "versions": [{"lessThan": "1.27_001", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.\n\nA perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.\n\nA perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-914", "description": "CWE-914 Improper Control of Dynamically-Identified Variables", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-05T06:50:17.532Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://github.com/ingydotnet/yaml-pm/issues/212"}, {"tags": ["patch"], "url": "https://github.com/ingydotnet/yaml-pm/commit/bace96b5e6661d521c7c515c94a09e081c911fce.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/TINITA/YAML-1.28/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to YAML 1.28 or later."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2019-04-27T00:00:00.000Z", "value": "Issue reported."}, {"lang": "en", "time": "2019-04-27T00:00:00.000Z", "value": "Version 1.27_001 released with fix."}, {"lang": "en", "time": "2019-04-28T00:00:00.000Z", "value": "Version 1.28 released with fix."}, {"lang": "en", "time": "2022-06-27T00:00:00.000Z", "value": "Issue added as CPANSA-YAML-2019-01 in the CPAN::Audit database."}, {"lang": "en", "time": "2026-09-21T00:00:00.000Z", "value": "CVE number reserved."}], "title": "YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution", "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade to YAML 1.28, set $YAML::LoadBlessed = 0 before loading untrusted input. The option exists from YAML 1.25 and gates glob loading too."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["YAML"], "packageName": "YAML", "packageURL": "pkg:cpan/YAML", "programFiles": ["lib/YAML/Types.pm"], "programRoutines": [{"name": "YAML::Type::glob::yaml_load"}], "repo": "https://github.com/ingydotnet/yaml-pm", "versions": [{"lessThan": "1.27_001", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.\n\nA perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.\n\nA perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code."}], "id": "CVE-2019-25777", "lastModified": "2026-10-05T07:16:29.557", "metrics": {}, "published": "2026-10-05T07:16:29.557", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/ingydotnet/yaml-pm/commit/bace96b5e6661d521c7c515c94a09e081c911fce.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/ingydotnet/yaml-pm/issues/212"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/TINITA/YAML-1.28/changes"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}, {"lang": "en", "value": "CWE-914"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"created": "2026-10-05T09:30:10.642122+00:00", "updated": "2026-10-05T09:30:10.642127+00:00", "vendors": []}