What’s Vulnerable › Vulnerabilities
CVE-2022-1471: Remote Code execution in SnakeYAML
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 99.5% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2022-12-01 · updated 2026-06-17
- Weakness: CWE-20
Description
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Affected products
- SnakeYAML: before 2.0 — fixed in 2.0
- Maven Org.Yaml:Snakeyaml: before 2.0; 1.10, 1.11, 1.12, 1.13, 1.14, 1.15 (+24) — fixed in 2.0
How to fix
Upgrade to a fixed version: SnakeYAML 2.0; Maven Org.Yaml:Snakeyaml 2.0. Check the vendor advisory for mitigations.
References
- http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html
- http://www.openwall.com/lists/oss-security/2023/11/19/1
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479
- https://confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-products-1296171009.html
- https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2
- https://github.com/mbechler/marshalsec
- https://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnc
- https://infosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4c
- https://security.netapp.com/advisory/ntap-20230818-0015/
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
- http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html
Get alerted when CVE-2022-1471 or the next vulnerability affects your stack