CVE-2017-20285
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes
Unknown product
CVSS
9.1CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.30CVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.
A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope.
What DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names.
Text from CVE List
Affected versions 1
- Productaffected: all versions before 1.30CVE List
References 4
- github.com/ingydotnet/yaml-pm/commit/471314bbdcbd62077eea32755929122aa8bd00a3.patchFixvia CVE List
- github.com/ingydotnet/yaml-pm/commit/7736f38bd02e4f9f77d5468721e3be3d7b34a8ec.patchFixvia CVE List
- github.com/ingydotnet/yaml-pm/issues/176Referencevia CVE List
- metacpan.org/release/TINITA/YAML-1.30/changesReferencevia CVE List