{"schema":"threatline.record/2","record":{"id":"CVE-2019-25777","aliases":[],"summary":"YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution","details":"YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.\n\nA perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.\n\nA perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.","categories":["Unclassified"],"product":"","vendor":"","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2019-25777","source_modified_at":"2026-10-06T16:58:19.261Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":null,"vendor":null,"versions":[{"lessThan":"1.27_001","status":"affected","version":"0","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2019-25777","source_modified_at":"2026-10-06T16:58:19.261Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":null,"ecosystem":null},"version":"1.27_001","basis":"first unaffected version stated in the CVE record"}],"cvss":7.3,"severity":"High","kev":{"listed":false},"epss":{"probability":0.0034,"percentile":0.26266,"score_date":"2026-10-23"},"published_at":"2026-10-05T06:50:17.532Z","modified_at":"2026-10-06T16:58:19.261Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2019-25777","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-06T16:58:19.261Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-25777","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/ingydotnet/yaml-pm/issues/212","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/ingydotnet/yaml-pm/commit/bace96b5e6661d521c7c515c94a09e081c911fce.patch","tags":["patch"]},{"source":"CVE List","url":"https://metacpan.org/release/TINITA/YAML-1.28/changes","tags":["release-notes"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-06T16:58:07.558999Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-06T16:58:19.261Z","content_hash":"3188877dfab9445835ab6aac4ac7648a0290ab64f0b03c7307f6e3be079ccb2e"}}