CVE-2022-1471
SnakeYaml Constructor Deserialization Remote Code Execution
8.3
HIGH
CVSS 3.1
EPSS 93.8%
Description
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
How to fix CVE-2022-1471
To remediate CVE-2022-1471, upgrade the affected package to a fixed version below.
- —no fix listed
- —upgrade to 2.0 or later
Is CVE-2022-1471 being exploited?
Likely — EPSS is 93.8%, placing CVE-2022-1471 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.
Affected packages (2)
- from 0
- from 0, < 2.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L |