CVE-2017-18342

In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.

• CWE-502

• https://github.com/marshmallow-code/apispec/issues/278Third Party Advisory
• https://github.com/yaml/pyyaml/blob/master/CHANGESRelease Notes, Third Party Advisory
• https://github.com/yaml/pyyaml/issues/193Third Party Advisory
• https://github.com/yaml/pyyaml/pull/74Patch, Third Party Advisory
• https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load%28input%29-Deprecation
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA/
• https://security.gentoo.org/glsa/202003-45Third Party Advisory
• https://github.com/marshmallow-code/apispec/issues/278Third Party Advisory
• https://github.com/yaml/pyyaml/blob/master/CHANGESRelease Notes, Third Party Advisory
• https://github.com/yaml/pyyaml/issues/193Third Party Advisory
• https://github.com/yaml/pyyaml/pull/74Patch, Third Party Advisory
• https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load%28input%29-Deprecation
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA/
• https://security.gentoo.org/glsa/202003-45Third Party Advisory

Published

Jun 27, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-18337Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-18338Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-18339Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-1834Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-18340Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-18341Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-18343The debug handler in Symfony before v2.7.33, 2.8.x before v2…
• CVE-2017-18344The timer_create syscall implementation in kernel/time/posix…
• CVE-2017-18345The Joomanager component through 2.0.0 for Joomla! has an ar…
• CVE-2017-18346SQL injection vulnerability in /wbg/core/_includes/authoriza…
• CVE-2017-18347Incorrect access control in RDP Level 1 on STMicroelectronic…4.6
• CVE-2017-18348Splunk Enterprise 6.6.x, when configured to run as root but …