Unverified50% confidenceFactExact time
In LSCBench's Java config importer case, the agent rewrote the missing core file, and all 14 hidden functional tests passed, but all 4 security tests failed, because it used SnakeYAML's default constructor, which executes every !!class tag in the uploaded YAML.
1
Sources
50%
Confidence
Long-term
Relevance
10/14/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedSnakeYAML's default load() or new Yaml() supports !! type tags, which can trigger instantiation of arbitrary Java classes, corresponding to the CWE-502 untrusted data deserialization vulnerability; the defense is to use SafeConstructor, a Constructor whitelist, or LoaderOptions to restrict the types that can be parsed.72% similarUnverifiedIn a test with a nested configuration object, encoded using OpenAI's cl100k_base tokenizer, JSON was 99 tokens and 322 characters, while YAML was 66 tokens and 223 characters, with YAML reducing the token count by 33.3%.64% similarUnverified在Ruby中应避免对不可信YAML使用YAML.load，而应使用YAML.safe_load58% similarUnverifiedPython 的 safe_load 只能解析单文档 YAML，而 js-yaml 库的 YAML.parse 支持多文档解析及 YAML 锚点、别名和 CloudFormation 的 !Sub 等自定义标签58% similarUnverifiedThe rules of agent-ops-check are written in YAML, the engine is based on regex matching, the report supports four formats—HTML, JSON, Markdown, and SARIF—and the local UI only listens on 127.0.0.1.57% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1032208API
curl https://kongchang.com/api/v1/knowledge/claims/1032208MCP
get_claim(id=1032208)