CVE-2019-25777

HighCVSS 7.3

Published: 05/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 05/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

YAML before version 1.27_001 for Perl allows a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. The document can enable code loading options that are off by default.

Risk Assessment

An attacker can execute arbitrary Perl code in the process, potentially leading to full system compromise or data integrity violation.

Recommendation

Update YAML to version 1.27_001 or later and avoid loading untrusted YAML documents.

Other vulnerabilities in YAML

CVE-2017-20285Critical
YAML before version 1.30 for Perl allows a loaded document to trigger the DESTROY method of arbitrary classes. The perl/hash:Class tag blesses a hash into the class it names, and Perl calls DESTROY when it goes out of scope.

Original NVD description (English source)

YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options. A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS