Profile My skills Saved Collections Edit profile Submit a skill

Unsafe YAML Deserialization

Detects YAML parsing using unsafe loaders that execute arbitrary Python or Ruby code embedded in YAML.

zakirkun Updated
Coding & Dev Tools

File contents

Unsafe YAML Deserialization

Overview

YAML loaders that support the full YAML specification (including !!python/object/apply:) can execute arbitrary code when parsing malicious YAML documents.

Python's yaml.load() without Loader=yaml.SafeLoader is the most common instance.

Malicious payload:

!!python/object/apply:os.system ["id"]

Remediation

  • Python: Use yaml.safe_load() or yaml.load(data, Loader=yaml.SafeLoader)
  • Ruby: Use YAML.safe_load() instead of YAML.load()
  • Node.js: js-yaml uses safeLoad (default safe, but load() with unsafe=true is dangerous)

zakirkun/ice-tea/tree/main/skills/deserialization/yaml-unsafe-load commit 30fcda636f

Browse category

Frequently asked questions

npx skillmds@latest add zakirkun/unsafe-yaml-deserialization