CVE-2017-18342
PyYAML insecurely deserializes YAML strings leading to arbitrary code execution
CVE-2017-18342 is a critical vulnerability (CVSS 9.8) in Pyyaml, published June 27, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.66%, the 92nd percentile. Fixed in pyyaml 5.1.
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
- Record
CVE-2017-18342- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-502
- Updated
- 2026-11-02
CVE List No score
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
- Record
CVE-2017-18342- Updated
- 2026-11-02
EUVDEUVD-2018-0128 No score
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
- Record
EUVD-2018-0128- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rprw-h62v-c2w7
PyYAML insecurely deserializes YAML strings leading to arbitrary code execution
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code. In other words, yaml.safe_load is not used.
This was intended to be fixed in 4.1, but due to breaking changes, 4.1 was yanked and 5.1 contains the patch for CVE-2017-18342.
- Record
GHSA-rprw-h62v-c2w7- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVBELL-CVE-2017-18342
CVE-2017-18342 does not affect BellSoft software
- Record
BELL-CVE-2017-18342- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
- Record
CVE-2017-18342- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 15 moreShow less
OSVDEBIAN-CVE-2017-18342
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
- Record
DEBIAN-CVE-2017-18342- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-rprw-h62v-c2w7
PyYAML insecurely deserializes YAML strings leading to arbitrary code execution
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code. In other words, yaml.safe_load is not used.
This was intended to be fixed in 4.1, but due to breaking changes, 4.1 was yanked and 5.1 contains the patch for CVE-2017-18342.
- Record
GHSA-rprw-h62v-c2w7- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-18342
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
- Record
UBUNTU-CVE-2017-18342- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2025-1766103244 No score
TuxCare security update for pyyaml (2 CVEs)
TuxCare rebuilt pyyaml to address 2 CVEs. Fixed in 3.13.post1+tuxcare.
- Record
CLSA-2025-1766103244- Updated
- 2026-11-02
OSVMGASA-2019-0125 No score
Updated python-yaml packages fix security vulnerability
It was found that using yaml.load() API on untrusted input could lead to arbitrary code execution (CVE-2017-18342).
- Record
MGASA-2019-0125- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11108-1 No score
oci-cli-3.0.2-1.2 on GA media
These are all security issues fixed in the oci-cli-3.0.2-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11108-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11210-1 No score
python36-PyYAML-5.4.1-1.6 on GA media
These are all security issues fixed in the python36-PyYAML-5.4.1-1.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11210-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11247-1 No score
python36-openapi-spec-validator-0.2.9-1.5 on GA media
These are all security issues fixed in the python36-openapi-spec-validator-0.2.9-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11247-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14089-1 No score
python310-PyYAML-6.0.1-4.1 on GA media
These are all security issues fixed in the python310-PyYAML-6.0.1-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14089-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14152-1 No score
python310-openapi-spec-validator-0.7.1-1.3 on GA media
These are all security issues fixed in the python310-openapi-spec-validator-0.7.1-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14152-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11192-1 No score
python313-openapi-spec-validator-0.9.0-1.1 on GA media
These are all security issues fixed in the python313-openapi-spec-validator-0.9.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11192-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11996-1 No score
python313-PyYAML-6.0.3-1.6 on GA media
These are all security issues fixed in the python313-PyYAML-6.0.3-1.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11996-1- Updated
- 2026-11-02
OSVPYSEC-2018-49 No score
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
- Record
PYSEC-2018-49- Updated
- 2026-11-02
OSVSUSE-FU-2022:0444-1 No score
Feature update for venv-salt-minion
This feature update for venv-salt-minion provides the following changes:
- Introduce
venv-salt-minion. - Track already fixed issues.
- Record
SUSE-FU-2022:0444-1- Updated
- 2026-11-02
OSVSUSE-FU-2022:0445-1 No score
Feature update for venv-salt-minion
This feature update for venv-salt-minion provides the following changes:
- Introduce
venv-salt-minion. - Mention fixed issues provided with the bundle.
- Record
SUSE-FU-2022:0445-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pyyamlPyPI |
before 5.1 | 5.1 |
pyyamlTuxCare:PyPI |
3.13 up to 3.13.post1+tuxcare | 3.13.post1+tuxcare |
pyyamlDebian:12 |
before 5.1.2-1 | 5.1.2-1 |
pyyamlDebian:13 |
before 5.1.2-1 | 5.1.2-1 |
pyyamlDebian:14 |
before 5.1.2-1 | 5.1.2-1 |
pyyamlPyPI |
before 5.1, plus listed versions 3.013.023.033.043.05 Show 17 moreShow less3.063.073.083.093.103.113.123.133.13b13.13rc14.2b14.2b24.2b45.1b15.1b35.1b55.1b7 |
5.1 |
python-yamlMageia:6 |
before 5.1-1.1.mga6 | 5.1-1.1.mga6 |
pyyamlUbuntu:14.04:LTS |
All versions, plus listed versions 3.10-4build23.10-4build33.10-4build43.10-4ubuntu0.1 |
None known |
pyyamlUbuntu:16.04:LTS |
All versions, plus listed versions 3.11-2build13.11-33.11-3build1 |
None known |
pyyamlUbuntu:18.04:LTS |
All versions, plus listed versions 3.12-1build2 |
None known |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
oci-cliopenSUSE:Tumbleweed |
before 3.0.2-1.2 | 3.0.2-1.2 |
python-PyYAMLopenSUSE:Tumbleweed |
before 5.4.1-1.6 | 5.4.1-1.6 |
python-PyYAMLopenSUSE:Tumbleweed |
before 6.0.1-4.1 | 6.0.1-4.1 |
python-openapi-spec-validatoropenSUSE:Tumbleweed |
before 0.7.1-1.3 | 0.7.1-1.3 |
python-openapi-spec-validatoropenSUSE:Tumbleweed |
before 0.9.0-1.1 | 0.9.0-1.1 |
python-PyYAMLopenSUSE:Tumbleweed |
before 6.0.3-1.6 | 6.0.3-1.6 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/yaml/pyyaml/pull/74
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA
Show 194 moreShow less
security.gentoo.org/glsa/202003-45
nvd.nist.gov/vuln/detail/CVE-2017-18342
docs.bell-sw.com/security/cves/CVE-2017-18342
security-tracker.debian.org/tracker/CVE-2017-18342
advisories.mageia.org/MGASA-2019-0125.html
bugs.mageia.org/show_bug.cgi?id=23242
suse.com/support/update/announcement/-2022-444/suse-fu-20220444-1
bugzilla.suse.com/1000080
ubuntu.com/security/CVE-2017-18342
cve.org/CVERecord?id=CVE-2017-18342
Left out here: 493 references. The JSON record has them.