CVE-2018-1000210

YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of Deserializer.Deserialize() will deserialize user-controlled types in the line "currentType = Type.GetType(nodeEvent.Tag.Substring(1), throwOnError: false);" and blindly instantiates them. that can result in Code execution in the context of the running process. This attack appear to be exploitable via Victim must parse a specially-crafted YAML file. This vulnerability appears to have been fixed in 5.0.0.

• CWE-502
• CWE-639

• https://github.com/aaubry/YamlDotNet#version-500Third Party Advisory
• https://github.com/aaubry/YamlDotNet/blob/f96b7cc40a0498f8bafdeb49df3aa23aa2c60993/YamlDotNet/Serialization/NodeTypeResolvers/TypeNameInTagNodeTypeResolver.cs#L35Third Party Advisory
• https://github.com/aaubry/YamlDotNet#version-500Third Party Advisory
• https://github.com/aaubry/YamlDotNet/blob/f96b7cc40a0498f8bafdeb49df3aa23aa2c60993/YamlDotNet/Serialization/NodeTypeResolvers/TypeNameInTagNodeTypeResolver.cs#L35Third Party Advisory

Published

Jul 13, 2018

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000204Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_…
• CVE-2018-1000205U-Boot contains a CWE-20: Improper Input Validation vulnerab…5.5
• CVE-2018-1000206JFrog Artifactory version since 5.11 contains a Cross ite Re…
• CVE-2018-1000207MODX Revolution version <=2.6.4 contains a Incorrect Access …
• CVE-2018-1000208MODX Revolution version <=2.6.4 contains a Directory Travers…
• CVE-2018-1000209Sensu, Inc. Sensu Core version Before version 1.4.2-3 contai…
• CVE-2018-1000211Doorkeeper version 4.2.0 and later contains a Incorrect Acce…
• CVE-2018-1000212Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-1000213Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-1000214Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-1000215Dave Gamble cJSON version 1.7.6 and earlier contains a CWE-7…
• CVE-2018-1000216Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-4…