Deserialization of Untrusted Data in JYaml

KRITISCH 9.8CVE-2020-8441 · GHSA-4qhr-q7wf-94xp · Published 19/02/2020 · updated 17/06/2026

Kurz gesagt

CVE-2020-8441 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in org.jyaml:jyaml, jyaml (jyaml project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 5.0%, höher als bei 92.2% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
org.jyaml:jyaml Maven	`≤ 1.3`	No fix yet
jyaml jyaml_project	`≤ 1.3`	No fix yet

Description

JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function. NOTE: this is a discontinued product.

NVD description

JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function. NOTE: this is a discontinued product.

References

nvd.nist.gov/vuln/detail/CVE-2020-8441 · ADVISORY
gist.github.com/j0lt-github/f5141abcacae63d434ecae211422153a · WEB
mbechler/marshalsec · WEB
mbechler/marshalsec · WEB
security.netapp.com/advisory/ntap-20200313-0001 · WEB
sourceforge.net/p/jyaml/bugs · WEB
security.netapp.com/advisory/ntap-20200313-0001
sourceforge.net/p/jyaml/bugs · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free