CVE-2017-20285
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of…
- Risk score
- 64/100
- CVSS
- 9.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on the classes the process …
- Affected
- See advisory
- Fix
- Upgrade the product to 1.30 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.1 critical
- Remotely exploitable without logging in
References
- https://github.com/ingydotnet/yaml-pm/commit/471314bbdcbd62077eea32755929122aa8bd00a3.patch
- https://github.com/ingydotnet/yaml-pm/commit/7736f38bd02e4f9f77d5468721e3be3d7b34a8ec.patch
- https://github.com/ingydotnet/yaml-pm/issues/176
- https://metacpan.org/release/TINITA/YAML-1.30/changes
- http://www.openwall.com/lists/oss-security/2026/10/05/8
Original description
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names.
Last activity 5 Oct 2026. Patch Forecast updates every hour.