CVE-2019-20478
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application...
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.
- Record
CVE-2019-20478- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE ListNo score
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.
- Record
CVE-2019-20478- Updated
- 2026-11-02
EUVDEUVD-2019-11022No score
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.
- Record
EUVD-2019-11022- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xg77-mvwp-crp2No score
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application...
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.
- Record
GHSA-xg77-mvwp-crp2- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.
- Record
CVE-2019-20478- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-20478
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.
- Record
DEBIAN-CVE-2019-20478- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2019-20478
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.
- Record
UBUNTU-CVE-2019-20478- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11271-1No score
python36-ruamel.yaml-0.17.10-1.2 on GA media
These are all security issues fixed in the python36-ruamel.yaml-0.17.10-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11271-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14164-1No score
python310-ruamel.yaml-0.18.6-1.2 on GA media
These are all security issues fixed in the python310-ruamel.yaml-0.18.6-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14164-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11904-1No score
python313-ruamel.yaml-0.19.1-2.1 on GA media
These are all security issues fixed in the python313-ruamel.yaml-0.19.1-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11904-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ruamel.yamlDebian:12 | All versions, plus listed versions 0.17.21-10.18.10+ds-10.18.14-10.18.14-20.18.14-3 Show 7 moreShow less0.18.14-40.18.5-1~exp10.18.6+ds-10.18.6+ds-20.18.6+ds-30.18.6-10.18.6-2 | None known |
ruamel.yamlDebian:13 | All versions, plus listed versions 0.18.10+ds-10.18.14-10.18.14-20.18.14-30.18.14-4 | None known |
ruamel.yamlDebian:14 | All versions, plus listed versions 0.18.10+ds-10.18.14-10.18.14-20.18.14-30.18.14-4 | None known |
ruamel.yamlUbuntu:16.04:LTS | All versions, plus listed versions 0.10.12-10.10.12-20.10.12-2build10.10.23-1 | None known |
ruamel.yamlUbuntu:18.04:LTS | All versions, plus listed versions 0.13.4-2build20.15.34-1 | None known |
ruamel.yamlUbuntu:20.04:LTS | All versions, plus listed versions 0.15.34-1build20.15.89-10.15.89-30.15.89-3build1 | None known |
ruamel.yamlUbuntu:22.04:LTS | All versions, plus listed versions 0.16.12-20.17.16-1 | None known |
ruamel.yamlUbuntu:24.04:LTS | All versions, plus listed versions 0.17.21-1 | None known |
ruamel.yamlUbuntu:25.10 | All versions, plus listed versions 0.18.10+ds-1 | None known |
ruamel.yamlUbuntu:26.10 | All versions, plus listed versions 0.18.10+ds-1build10.18.14-4 | None known |
ruamel.yamlUbuntu:26.04:LTS | All versions, plus listed versions 0.18.10+ds-10.18.10+ds-1build1 | None known |
python-ruaeml.yamlopenSUSE:Tumbleweed | before 0.18.6-1.2 | 0.18.6-1.2 |
python-ruamel.yamlopenSUSE:Tumbleweed | before 0.19.1-2.1 | 0.19.1-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-20478 is a critical vulnerability (CVSS 9.8) in Ruamel.yaml Project Ruamel.yaml, published February 19, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.83%, the 94th percentile. Fixed in python-ruaeml.yaml 0.18.6-1.2.