CVE-2018-1000210
High severity vulnerability that affects YamlDotNet and YamlDotNet.Signed
CVE-2018-1000210 is a high vulnerability (CVSS 7.8) in Yamldotnet Project Yamldotnet, published July 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 74th percentile. Fixed in YamlDotNet 5.0.0.
- Severity
- 7.8 HighCVSS 3.0, NVD
- Exploit chance
- 1.47%EPSS, 74th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.0.0YamlDotNet +3 more
Description
YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of Deserializer.Deserialize() will deserialize user-controlled types in the line "currentType = Type.GetType(nodeEvent.Tag.Substring(1), throwOnError: false);" and blindly instantiates them. that can result in Code execution in the context of the running process. This attack appear to be exploitable via Victim must parse a specially-crafted YAML file. This vulnerability appears to have been fixed in 5.0.0.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
YamlDotNetNuGet | through 4.3.2 | 5.0.0 |
YamlDotNet.SignedNuGet | through 4.3.2 | 5.0.0 |
YamlDotNetNuGet | before 5.0.0, plus listed versions 2.3.0-rc3.0.03.1.03.1.13.2.0 Show 45 moreShow less3.2.13.2.23.3.03.3.13.4.03.5.03.5.13.6.03.6.13.7.03.7.0-pre1293.8.03.8.0-pre1383.8.0-pre1433.8.0-pre1453.8.0-pre1463.8.0-pre1473.8.0-pre1483.8.0-pre1553.8.0-pre1563.8.0-pre1583.8.0-pre1593.8.0-pre1613.8.0-pre1623.8.0-pre1673.8.0-pre1693.8.0-pre1703.8.0-pre1713.8.0-pre1753.8.0-pre1783.8.0-pre1843.8.0-pre1853.8.0-pre1863.8.0-pre1873.8.0-pre1883.8.0-pre1893.8.0-pre1903.8.0-pre1913.8.0-pre1933.8.0-pre1943.8.0-pre1953.8.0-pre1963.8.0-pre1973.8.0-pre1983.8.0-pre199 | 5.0.0 |
YamlDotNet.SignedNuGet | before 5.0.0, plus listed versions 3.3.13.4.03.5.03.5.13.6.0 Show 45 moreShow less3.6.13.7.03.7.0-pre1293.8.03.8.0-pre1433.8.0-pre1453.8.0-pre1463.8.0-pre1473.8.0-pre1483.8.0-pre1553.8.0-pre1563.8.0-pre1583.8.0-pre1593.8.0-pre1613.8.0-pre1623.8.0-pre1673.8.0-pre1693.8.0-pre1703.8.0-pre1713.8.0-pre1753.8.0-pre1783.8.0-pre1843.8.0-pre1853.8.0-pre1863.8.0-pre1873.8.0-pre1883.8.0-pre1893.8.0-pre1903.8.0-pre1913.8.0-pre1933.8.0-pre1943.8.0-pre1953.8.0-pre1963.8.0-pre1973.8.0-pre1983.8.0-pre1993.8.0-pre2003.8.0-pre2013.8.0-pre2033.8.0-pre2063.8.0-pre2093.8.0-pre2103.8.0-pre2113.8.0-pre2143.8.0-pre221 | 5.0.0 |
What each source reports
NVD Score used
YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of Deserializer.Deserialize() will deserialize user-controlled types in the line "currentType = Type.GetType(nodeEvent.Tag.Substring(1), throwOnError: false);" and blindly instantiates them. that can result in Code execution in the context of the running process. This attack appear to be exploitable via Victim must parse a specially-crafted YAML file. This vulnerability appears to have been fixed in 5.0.0.
- Record
CVE-2018-1000210- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-502, CWE-639
- Updated
- 2026-11-02
CVE ListNo score
YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of Deserializer.Deserialize() will deserialize user-controlled types in the line "currentType = Type.GetType(nodeEvent.Tag.Substring(1), throwOnError: false);" and blindly instantiates them. that can result in Code execution in the context of the running process. This attack appear to be exploitable via Victim must parse a specially-crafted YAML file. This vulnerability appears to have been fixed in 5.0.0.
- Record
CVE-2018-1000210- Updated
- 2026-11-02
EUVDEUVD-2018-0686No score
YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of Deserializer.Deserialize() will deserialize user-controlled types in the line "currentType = Type.GetType(nodeEvent.Tag.Substring(1), throwOnError: false);" and blindly instantiates them. that can result in Code execution in the context of the running process. This attack appear to be exploitable via Victim must parse a specially-crafted YAML file. This vulnerability appears to have been fixed in 5.0.0.
- Record
EUVD-2018-0686- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rpch-cqj9-h65r
High severity vulnerability that affects YamlDotNet and YamlDotNet.Signed
YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of Deserializer.Deserialize() will deserialize user-controlled types in the line "currentType = Type.GetType(nodeEvent.Tag.Substring(1), throwOnError: false);" and blindly instantiates them. that can result in Code execution in the context of the running process. This attack appear to be exploitable via Victim must parse a specially-crafted YAML file. This vulnerability appears to have been fixed in 5.0.0.
- Record
GHSA-rpch-cqj9-h65r- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-502, CWE-639
- Updated
- 2026-11-02
OSV
YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of Deserializer.Deserialize() will deserialize user-controlled types in the line "currentType = Type.GetType(nodeEvent.Tag.Substring(1), throwOnError: false);" and blindly instantiates them. that can result in Code execution in the context of the running process. This attack appear to be exploitable via Victim must parse a specially-crafted YAML file. This vulnerability appears to have been fixed in 5.0.0.
- Record
CVE-2018-1000210- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-rpch-cqj9-h65r
High severity vulnerability that affects YamlDotNet and YamlDotNet.Signed
YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of Deserializer.Deserialize() will deserialize user-controlled types in the line "currentType = Type.GetType(nodeEvent.Tag.Substring(1), throwOnError: false);" and blindly instantiates them. that can result in Code execution in the context of the running process. This attack appear to be exploitable via Victim must parse a specially-crafted YAML file. This vulnerability appears to have been fixed in 5.0.0.
- Record
GHSA-rpch-cqj9-h65r- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-502, CWE-639
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 220 versions. The JSON record has them.