{"id":"CVE-2019-25777","title":"YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.\n\nA perl/glob document names a package and a symbol, and supplies the value assigned to …","summary":"YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.\n\nA perl/glob document names a package and a symbol, and supplies the value assigned to …","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":["CWE-502","CWE-914"],"product":"YAML","affected":["YAML < 1.27_001"],"published":"2026-10-05","updated":"2026-10-06","sourceUpdated":"2026-10-06T17:17:09.893","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-25777","references":[{"url":"https://github.com/ingydotnet/yaml-pm/commit/bace96b5e6661d521c7c515c94a09e081c911fce.patch","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://github.com/ingydotnet/yaml-pm/issues/212","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/TINITA/YAML-1.28/changes","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/05/7","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-25777.json"},{"url":"https://access.redhat.com/security/cve/CVE-2019-25777"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545818"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25777"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25777"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-06T16:58:07.558999Z"},"epss":0.00352,"epssPercentile":0.28659,"ingestedAt":"2026-10-05T07:14:48.255Z","vendor":"Red Hat","scores":{"nvd":7.3,"vendor":8.1},"slug":"CVE-2019-25777","body":"## Overview\n\nYAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.\n\nA perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.\n\nA perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-06 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-25777.json)","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":216581,"id":"CVE-2019-25777","ts":1791306653185,"field":"cvss","old":null,"new":"7.3"},{"seq":216580,"id":"CVE-2019-25777","ts":1791306653185,"field":"severity","old":"none","new":"high"}]}