CVE-2022-1471 Remote Code execution in SnakeYAML
Attackers can achieve remote code execution by providing malicious YAML content to applications using SnakeYAML's unsafe Constructor class.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-1471?
CVE-2022-1471 is a high-severity unsafe deserialization vulnerability in SnakeYAML, published on 1 Dec 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Which versions are affected by CVE-2022-1471?
2 open source packages ship an affected version, including org.yaml:snakeyaml. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.yaml:snakeyaml Maven | All versions | 2.0 |
org.yaml:snakeyaml Maven | All versions | 2.0 |
Linux distribution packages (9)
prometheus-jmx-exporter AlmaLinux:8 | All versions | 0.12.0-9.el8_7 |
prometheus-jmx-exporter-openjdk11 AlmaLinux:8 | All versions | 0.12.0-9.el8_7 |
prometheus-jmx-exporter-openjdk17 AlmaLinux:8 | All versions | 0.12.0-9.el8_7 |
prometheus-jmx-exporter-openjdk8 AlmaLinux:8 | All versions | 0.12.0-9.el8_7 |
prometheus-jmx-exporter Red Hat:enterprise_linux:8::appstream | All versions | 0:0.12.0-9.el8_7 |
prometheus-jmx-exporter-openjdk11 Red Hat:enterprise_linux:8::appstream | All versions | 0:0.12.0-9.el8_7 |
prometheus-jmx-exporter-openjdk17 Red Hat:enterprise_linux:8::appstream | All versions | 0:0.12.0-9.el8_7 |
prometheus-jmx-exporter-openjdk8 Red Hat:enterprise_linux:8::appstream | All versions | 0:0.12.0-9.el8_7 |
prometheus-jmx-exporter Rocky Linux:8 | All versions | 0:0.12.0-9.el8_7 |
Products include Snakeyaml Project Snakeyaml.
How do I fix CVE-2022-1471?
Upgrade org.yaml:snakeyaml to 2.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-1471 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-1471 exists.
Public exploit code: 1 Metasploit module and 7 proofs of concept on GitHub.
Other vulnerabilities in SnakeYAML
Sources
Also known as ALSA-2022:9058, CLEANSTART-2026-LU07367, CLEANSTART-2026-ND79703, CLEANSTART-2026-QU79402, CLSA-2024-1732492822, CLSA-2025-1751328253 and 22 more.