YAML.pm for Perl: Deserialization of blessed objects triggers DESTROY methods
Summary
YAML.pm before version 1.30 for Perl lets a crafted YAML document create objects of arbitrary classes through perl/hash tags. Perl then calls the DESTROY method of these classes when the objects go out of scope. Depending on the classes loaded in the process, for example File::Temp::Dir from core Perl, an attacker can delete directory trees named in the document. The attack requires that an application loads attacker-influenced YAML with this library.
Affected
- YAML.pm versions before 1.30
Fixed in
- YAML.pm 1.30 or later
Workaround
- Set $YAML::LoadBlessed = 0 before loading untrusted input (option available from YAML 1.25)
Exploitation
- No evidence of exploitation in the wild found at the time of research.
- CISA SSVC: Exploitation none, automatable yes, technical impact total.
- EPSS: 0.00184.
Our recommendation
- Inventory Perl YAML usage on servers and in scripts, including the libyaml-perl and perl-YAML packages.
- Upgrade to YAML.pm 1.30 or later, or install the vendor's patched package where available.
- Where an upgrade is not possible, set $YAML::LoadBlessed = 0 before loading untrusted input.
- Check for YAML input from external sources such as web uploads and API payloads and restrict it.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 471314bb (yaml-pm) github.com
- Fix commit 7736f38b (yaml-pm) github.com
- yaml-pm issue 176 github.com
- YAML 1.30 changelog metacpan.org
- oss-security advisory www.openwall.com
- OSV record CVE-2017-20285 osv.dev
- Debian OSV record osv.dev
- Ubuntu security tracker ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:31.
Original description (NVD)
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names.
NVD references (5)
- https://github.com/ingydotnet/yaml-pm/commit/471314bbdcbd62077eea32755929122aa8bd00a3.patch
- https://github.com/ingydotnet/yaml-pm/commit/7736f38bd02e4f9f77d5468721e3be3d7b34a8ec.patch
- https://github.com/ingydotnet/yaml-pm/issues/176
- https://metacpan.org/release/TINITA/YAML-1.30/changes
- http://www.openwall.com/lists/oss-security/2026/10/05/8
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.