CVE-2017-20285 PUBLISHED

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes

Assigner: CPANSec
Reserved: 21.09.2026 Published: 05.10.2026 Updated: 05.10.2026

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.

A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope.

What DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names.

Product Status

Package Collection https://cpan.org/modules
Package Name YAML
Versions Default: unaffected
  • affected from 0 to 1.30 (excl.)

Workarounds

For deployments that cannot upgrade to YAML 1.30, set $YAML::LoadBlessed = 0 before loading untrusted input. The option exists from YAML 1.25.

Solutions

Upgrade to YAML 1.30 or later.

References

Problem Types

  • CWE-502 Deserialization of Untrusted Data CWE
  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') CWE