SnakeYAML
A widely used YAML parsing library in the Java ecosystem. It supports YAML type tags, but its default configuration carries an insecure deserialization risk.
Timeline (last 90 days)
In LSCBench's Java config importer case, the agent rewrote the missing core file, and all 14 hidden functional tests passed, but all 4 security tests failed, because it used SnakeYAML's default constructor, which executes every !!class tag in the uploaded YAML.
SnakeYAML's default load() or new Yaml() supports !! type tags, which can trigger instantiation of arbitrary Java classes, corresponding to the CWE-502 untrusted data deserialization vulnerability; the defense is to use SafeConstructor, a Constructor whitelist, or LoaderOptions to restrict the types that can be parsed.
All Facts (2)
In LSCBench's Java config importer case, the agent rewrote the missing core file, and all 14 hidden functional tests passed, but all 4 security tests failed, because it used SnakeYAML's default constructor, which executes every !!class tag in the uploaded YAML.
50%UnverifiedSnakeYAML's default load() or new Yaml() supports !! type tags, which can trigger instantiation of arbitrary Java classes, corresponding to the CWE-502 untrusted data deserialization vulnerability; the defense is to use SafeConstructor, a Constructor whitelist, or LoaderOptions to restrict the types that can be parsed.
50%