{"id":"CVE-2019-25777","aliases":["ALSA-2026:93471","DEBIAN-CVE-2019-25777","EUVD-2019-20205","GHSA-38xx-2hm6-vh7q","RLSA-2026:93471","UBUNTU-CVE-2019-25777","USN-8925-1","openSUSE-SU-2026:12368-1"],"status":"published","title":"YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution","description":"YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.\n\nA perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.\n\nA perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00352,"percentile":0.29235,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502","CWE-914"],"published":"2026-10-05T06:50:17Z","modified":"2026-11-03T12:30:02Z","fixes":[{"ecosystem":"Debian:12","package":"libyaml-perl","fixed_in":["1.29-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libyaml-perl","fixed_in":["1.29-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libyaml-perl","fixed_in":["1.29-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libyaml-perl","fixed_in":["1.15-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libyaml-perl","fixed_in":["1.24-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-YAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24-4.module_el8.10.0+4341+ab0ec422"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-YAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24-4.module+el8.10.0+40403+bd06a93a"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-YAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24-4.module+el8.10.0+40403+df14587c"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-YAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24-4.module+el8.10.0+40403+94558160"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-YAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24-4.module+el8.10.0+40403+9457ea6c"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-1ubuntu0.1~esm1"}]}],"versions":["1.13-1","1.15-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24-1ubuntu0.1~esm1"}]}],"versions":["1.21-1","1.24-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-1ubuntu0.1~esm1"}]}],"versions":["1.13-1","1.15-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24-1ubuntu0.1~esm1"}]}],"versions":["1.21-1","1.24-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30-1ubuntu0.20.04.1~esm1"}]}],"versions":["1.29-1","1.30-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30-1ubuntu0.22.04.1"}]}],"versions":["1.30-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-1ubuntu0.24.04.1"}]}],"versions":["1.30-2","1.31-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-1ubuntu0.26.04.1~esm1"}]}],"versions":["1.31-1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-YAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.321.0-2.1"}]}],"bundled":2}],"references":[{"url":"https://github.com/ingydotnet/yaml-pm/issues/212","tags":["issue-tracking","report"]},{"url":"https://github.com/ingydotnet/yaml-pm/commit/bace96b5e6661d521c7c515c94a09e081c911fce.patch","tags":["patch","fix"]},{"url":"https://metacpan.org/release/TINITA/YAML-1.28/changes","tags":["release-notes","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/05/7","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25777"},{"url":"https://github.com/advisories/GHSA-38xx-2hm6-vh7q"},{"url":"https://access.redhat.com/errata/RHSA-2026:93471","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-20285","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25777","tags":["report"]},{"url":"https://bugzilla.redhat.com/2545818","tags":["report"]},{"url":"https://bugzilla.redhat.com/2545820","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-93471.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-25777","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:93471","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545820","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25777","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25777","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/05/7","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8925-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-20285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63676","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-20285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25777","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-25777","title":"YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution","description":"YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.\n\nA perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.\n\nA perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.","status":"published","published":"2026-10-05T06:50:17.532Z","modified":"2026-10-06T16:58:19.261Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-914","CWE-502"],"updated_at":"2026-11-02T14:20:19.399352Z"}],"euvd":[{"id":"EUVD-2019-20205","description":"YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.\n\nA perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.\n\nA perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.","status":"published","published":"2026-10-05T06:50:17Z","modified":"2026-10-06T16:58:19Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T17:27:37.140631Z"}],"ghsa":[{"id":"GHSA-38xx-2hm6-vh7q","title":"YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package...","description":"YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.\n\nA perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.\n\nA perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.","status":"published","published":"2026-10-05T09:31:51Z","modified":"2026-10-06T18:31:27Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:12:51.459076Z"}],"nvd":[{"id":"CVE-2019-25777","description":"YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.\n\nA perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.\n\nA perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.","status":"published","published":"2026-10-05T07:16:29.557Z","modified":"2026-10-06T17:17:09.893Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-502","CWE-914"],"updated_at":"2026-11-02T14:05:50.275357Z"}],"osv":[{"id":"CVE-2019-25777","description":"YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.\n\nA perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.\n\nA perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.","status":"published","published":"2026-10-05T07:16:29.557Z","modified":"2026-11-03T12:26:57.054460418Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T13:02:16.068655Z"},{"id":"DEBIAN-CVE-2019-25777","description":"YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.  A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.  A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.","status":"published","published":"2026-10-05T07:16:29.557Z","modified":"2026-10-07T10:00:04.151212613Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"RLSA-2026:93471","title":"Important: perl-YAML:1.24 security update","description":"he perl-YAML package provides the pure-Perl implementation of the YAML (YAML Ain't Markup Language) data serialization standard. It allows developers to serialize Perl data structures into formatted YAML text and deserialize YAML data back into native Perl structures, making it widely used for configuration files, data exchange, and human-readable data storage in Perl applications.\n\nSecurity Fix(es):\n\n* perl-yaml: perl-yaml: Arbitrary code execution via unrestricted package variable assignment (CVE-2019-25777)\n\n* perl-yaml: perl-yaml: Arbitrary destructor method execution via crafted YAML document (CVE-2017-20285)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-03T12:01:33.643841Z","modified":"2026-11-03T12:30:02.492446599Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T13:02:16.068655Z"},{"id":"UBUNTU-CVE-2019-25777","description":"YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options. A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.","status":"published","published":"2026-10-05T07:16:00Z","modified":"2026-10-14T11:45:06.688699843Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"ALSA-2026:93471","title":"Important: perl-YAML:1.24 security update","description":"he perl-YAML package provides the pure-Perl implementation of the YAML (YAML Ain't Markup Language) data serialization standard. It allows developers to serialize Perl data structures into formatted YAML text and deserialize YAML data back into native Perl structures, making it widely used for configuration files, data exchange, and human-readable data storage in Perl applications.  \n\nSecurity Fix(es):  \n\n  * perl-yaml: perl-yaml: Arbitrary code execution via unrestricted package variable assignment (CVE-2019-25777)\n  * perl-yaml: perl-yaml: Arbitrary destructor method execution via crafted YAML document (CVE-2017-20285)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-02T00:00:00Z","modified":"2026-11-03T12:15:02.400777762Z","updated_at":"2026-11-03T12:31:37.107381Z"},{"id":"openSUSE-SU-2026:12368-1","title":"perl-YAML-1.321.0-2.1 on GA media","description":"These are all security issues fixed in the perl-YAML-1.321.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-30T00:00:00Z","modified":"2026-10-31T18:00:06.6792209Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"USN-8925-1","title":"libyaml-perl vulnerabilities","description":"Dominique Dumont discovered that YAML-LibYAML did not correctly handle\ncertain reflection operations. If a user or system were tricked into\nopening a specially crafted file, an attacker could possibly use this issue\nto delete files. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04\nLTS. (CVE-2017-20285)\n\nIt was discovered that YAML-LibYAML did not correctly handle parsing\ncertain documents. If a user or automated system were tricked into opening\na specially crafted file, an attacker could possibly use this issue to\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2019-25777)\n\nIt was discovered that YAML-LibYAML contained a regular expression\nsusceptible to catastrophic backtracking. If a user or automated system\nwere tricked into opening a specially crafted file, an attacker could\npossibly use this issue to cause a denial of service. (CVE-2026-63676)","status":"published","published":"2026-10-14T03:31:33Z","modified":"2026-10-14T11:57:58.298079668Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}