YAML Perl Module <1.27_001: glob injection allows arbitrary code exec
CVE-2019-25777 Published on October 5, 2026
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.
A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.
A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.
Vulnerability Analysis
CVE-2019-25777 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be low. considered to have a small impact on confidentiality and integrity and availability.
Timeline
Issue reported.
Version 1.27_001 released with fix.
Version 1.28 released with fix. 1 day later.
Issue added as CPANSA-YAML-2019-01 in the CPAN::Audit database. 1156 days later.
CVE number reserved. 1547 days later.
Weakness Types
Improper Control of Dynamically-Identified Variables
The software does not properly restrict reading from or writing to dynamically-identified variables. Many languages offer powerful features that allow the programmer to access arbitrary variables that are specified by an input string. While these features can offer significant flexibility and reduce development time, they can be extremely dangerous if attackers can modify unintended variables that have security implications.
What is a Marshaling, Unmarshaling Vulnerability?
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVE-2019-25777 has been classified to as a Marshaling, Unmarshaling vulnerability or weakness.
Products Associated with CVE-2019-25777
Want to know whenever a new CVE is published for Canonical Ubuntu Linux? stack.watch will email you.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.