CVE-2020-14343

Name of the Vulnerable Software and Affected Versions PyYAML versions prior to 5.4

Description A flaw in the PyYAML library allows for arbitrary code execution when processing untrusted YAML files through the full load method or with the FullLoader loader. This issue enables an attacker to execute arbitrary code on the system by exploiting the python/object/new constructor. The vulnerability is due to incomplete input validation when handling untrusted input, which can be exploited by a remote attacker using a specially crafted file.

Recommendations For versions prior to 5.4, consider avoiding the use of the full load method or the FullLoader loader when processing untrusted YAML files until a patch is available. As a temporary workaround, restrict the processing of untrusted input to minimize the risk of exploitation.