Deserialization of Untrusted Data in JYaml

CRÍTICO 9.8CVE-2020-8441 · GHSA-4qhr-q7wf-94xp · Published 19/02/2020 · updated 17/06/2026

Em resumo

CVE-2020-8441 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta org.jyaml:jyaml, jyaml (jyaml project).
Chance de exploração nos próximos 30 dias (EPSS): 5.0%, maior que 92.2% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
org.jyaml:jyaml Maven	`≤ 1.3`	No fix yet
jyaml jyaml_project	`≤ 1.3`	No fix yet

Description

JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function. NOTE: this is a discontinued product.

NVD description

JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function. NOTE: this is a discontinued product.

References

nvd.nist.gov/vuln/detail/CVE-2020-8441 · ADVISORY
gist.github.com/j0lt-github/f5141abcacae63d434ecae211422153a · WEB
mbechler/marshalsec · WEB
mbechler/marshalsec · WEB
security.netapp.com/advisory/ntap-20200313-0001 · WEB
sourceforge.net/p/jyaml/bugs · WEB
security.netapp.com/advisory/ntap-20200313-0001
sourceforge.net/p/jyaml/bugs · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free