Unverified50% confidenceFactExact time
SnakeYAML's default load() or new Yaml() supports !! type tags, which can trigger instantiation of arbitrary Java classes, corresponding to the CWE-502 untrusted data deserialization vulnerability; the defense is to use SafeConstructor, a Constructor whitelist, or LoaderOptions to restrict the types that can be parsed.
1
Sources
50%
Confidence
Long-term
Relevance
10/14/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedIn LSCBench's Java config importer case, the agent rewrote the missing core file, and all 14 hidden functional tests passed, but all 4 security tests failed, because it used SnakeYAML's default constructor, which executes every !!class tag in the uploaded YAML.72% similarUnverifiedPython 的 safe_load 只能解析单文档 YAML，而 js-yaml 库的 YAML.parse 支持多文档解析及 YAML 锚点、别名和 CloudFormation 的 !Sub 等自定义标签69% similarUnverified在Ruby中应避免对不可信YAML使用YAML.load，而应使用YAML.safe_load69% similarUnverifiedYAML 相比 JSON 和 TOML 支持注释，已成为 Kubernetes、Docker Compose、GitHub Actions 等主流工具的配置标准64% similarUnverifiedas<T>() 在类型不匹配时会抛出 YAML::TypedBadConversion 异常，LoadFile 在文件不存在时会抛出 YAML::BadFile 异常63% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1032209API
curl https://kongchang.com/api/v1/knowledge/claims/1032209MCP
get_claim(id=1032209)