CVE-2019-20478 Deserialization in n/a
Remote code execution is possible in ruamel.yaml if the unsafe load method is used with untrusted input, requiring developers to use safe_load instead.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-20478?
CVE-2019-20478 is a critical unsafe deserialization vulnerability in n/a, published on 19 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.
Which versions are affected by CVE-2019-20478?
It affects 1 product.
Linux distribution packages (2)
python-ruaeml.yaml openSUSE:Tumbleweed | All versions | 0.18.6-1.2 |
python-ruamel.yaml openSUSE:Tumbleweed | All versions | 0.19.1-2.1 |
Products include Ruamel.yaml Project Ruamel.yaml.
How do I fix CVE-2019-20478?
Apply the vendor's patch.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2019-20478 being exploited?
There is no known exploitation of CVE-2019-20478 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2019-20478, GHSA-xg77-mvwp-crp2, UBUNTU-CVE-2019-20478, openSUSE-SU-2024:11271-1, openSUSE-SU-2024:14164-1, openSUSE-SU-2026:11904-1.