{"id":"CVE-2019-20478","aliases":["DEBIAN-CVE-2019-20478","EUVD-2019-11022","GHSA-xg77-mvwp-crp2","UBUNTU-CVE-2019-20478","openSUSE-SU-2024:11271-1","openSUSE-SU-2024:14164-1","openSUSE-SU-2026:11904-1"],"status":"published","title":"In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application...","description":"In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.06834,"percentile":0.94106,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2020-02-19T03:09:08Z","modified":"2026-10-17T12:56:07Z","fixes":[{"ecosystem":"openSUSE:Tumbleweed","package":"python-ruaeml.yaml","fixed_in":["0.18.6-1.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-ruamel.yaml","fixed_in":["0.19.1-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ruamel.yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.21-1","0.18.10+ds-1","0.18.14-1","0.18.14-2","0.18.14-3","0.18.14-4","0.18.5-1~exp1","0.18.6+ds-1","0.18.6+ds-2","0.18.6+ds-3","0.18.6-1","0.18.6-2"]},{"source":"osv","ecosystem":"Debian:13","package":"ruamel.yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.18.10+ds-1","0.18.14-1","0.18.14-2","0.18.14-3","0.18.14-4"]},{"source":"osv","ecosystem":"Debian:14","package":"ruamel.yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.18.10+ds-1","0.18.14-1","0.18.14-2","0.18.14-3","0.18.14-4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruamel.yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.12-1","0.10.12-2","0.10.12-2build1","0.10.23-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ruamel.yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.4-2build2","0.15.34-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruamel.yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.15.34-1build2","0.15.89-1","0.15.89-3","0.15.89-3build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruamel.yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.16.12-2","0.17.16-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruamel.yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.21-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ruamel.yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.18.10+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ruamel.yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.18.10+ds-1build1","0.18.14-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ruamel.yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.18.10+ds-1","0.18.10+ds-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-ruaeml.yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.6-1.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-ruamel.yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.1-2.1"}]}]}],"products":[{"vendor":"ruamel.yaml_project","product":"ruamel.yaml"}],"references":[{"url":"https://www.exploit-db.com/exploits/47655","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20478"},{"url":"https://github.com/advisories/GHSA-xg77-mvwp-crp2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-20478","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-20478","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20478","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20478","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-20478","description":"In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.","status":"published","published":"2020-02-19T03:09:08Z","modified":"2024-08-05T02:39:10Z","updated_at":"2026-11-02T14:20:17.11067Z"}],"euvd":[{"id":"EUVD-2019-11022","description":"In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.","status":"published","published":"2020-02-19T03:09:08Z","modified":"2024-08-05T02:39:10Z","updated_at":"2026-11-03T02:40:22.238276Z"}],"ghsa":[{"id":"GHSA-xg77-mvwp-crp2","title":"In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application...","description":"In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.","status":"published","published":"2022-05-24T17:09:19Z","modified":"2023-01-29T05:01:32Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:44:50.787695Z"}],"nvd":[{"id":"CVE-2019-20478","description":"In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.","status":"published","published":"2020-02-19T04:15:10.88Z","modified":"2026-06-17T02:30:32.717Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:05:43.875329Z"}],"osv":[{"id":"CVE-2019-20478","description":"In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.","status":"published","published":"2020-02-19T04:15:10.88Z","modified":"2026-09-29T18:26:42.545745189Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-20478","description":"In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.","status":"published","published":"2020-02-19T04:15:10.88Z","modified":"2026-09-21T07:02:09.456120845Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"UBUNTU-CVE-2019-20478","description":"In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.","status":"published","published":"2020-02-19T04:15:00Z","modified":"2026-10-17T12:56:07.993444208Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"openSUSE-SU-2024:11271-1","title":"python36-ruamel.yaml-0.17.10-1.2 on GA media","description":"These are all security issues fixed in the python36-ruamel.yaml-0.17.10-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:56:21.803529Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:14164-1","title":"python310-ruamel.yaml-0.18.6-1.2 on GA media","description":"These are all security issues fixed in the python310-ruamel.yaml-0.18.6-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T02:39:50.737738Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11904-1","title":"python313-ruamel.yaml-0.19.1-2.1 on GA media","description":"These are all security issues fixed in the python313-ruamel.yaml-0.19.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-28T00:00:00Z","modified":"2026-09-29T18:23:14.496344462Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}