Description
YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of Deserializer.Deserialize() will deserialize user-controlled types in the line "currentType = Type.GetType(nodeEvent.Tag.Substring(1), throwOnError: false);" and blindly instantiates them. that can result in Code execution in the context of the running process. This attack appear to be exploitable via Victim must parse a specially-crafted YAML file. This vulnerability appears to have been fixed in 5.0.0.
References (2)
Core 2
Core References
Third Party Advisory x_refsource_confirm
https://github.com/aaubry/YamlDotNet#version-500
Third Party Advisory x_refsource_confirm
https://github.com/aaubry/YamlDotNet/blob/f96b7cc40a0498f8bafdeb49df3aa23aa2c60993/YamlDotNet/Serialization/NodeTypeResolvers/TypeNameInTagNodeTypeResolver.cs#L35
Scores
CVSS v3
7.8
EPSS
0.0034
EPSS Percentile
56.6%
Attack Vector
LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-502
CWE-639
Status
published
Products (3)
nuget/YamlDotNet
0 - 5.0.0NuGet
nuget/YamlDotNet.Signed
0 - 5.0.0NuGet
yamldotnet_project/yamldotnet
< 4.3.2
Published
Jul 13, 2018
Tracked Since
Feb 18, 2026