| Package | Affected versions | Patched versions |
|---|---|---|
| pyyaml | < 5.1 | 5.1 |
| pyyaml | < 5.1 | 5.1 |
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code. In other words, yaml.safe_load is not used.
This was intended to be fixed in 4.1, but due to breaking changes, 4.1 was yanked and 5.1 contains the patch for CVE-2017-18342.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free