CVE-2020-1747

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.

• CWE-20
• CWE-20

• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00017.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00017.htmlMailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1747Issue Tracking, Patch, Third Party Advisory
• https://github.com/yaml/pyyaml/pull/386Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7PPAS6C4SZRDQLR7C22A5U3QOLXY33JX/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K5HEPD7LEVDPCITY5IMDYWXUMX37VFMY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MMQXSZXNJT6ERABJZAAICI3DQSQLCP3D/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WORRFHPQVAFKKXXWLSSW6XKUYLWM6CSH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBJA3SGNJKCAYPSHOHWY3KBCWNM5NYK2/
• https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00017.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00017.htmlMailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1747Issue Tracking, Patch, Third Party Advisory
• https://github.com/yaml/pyyaml/pull/386Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7PPAS6C4SZRDQLR7C22A5U3QOLXY33JX/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K5HEPD7LEVDPCITY5IMDYWXUMX37VFMY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MMQXSZXNJT6ERABJZAAICI3DQSQLCP3D/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WORRFHPQVAFKKXXWLSSW6XKUYLWM6CSH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBJA3SGNJKCAYPSHOHWY3KBCWNM5NYK2/
• https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory

Published

Mar 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-17464Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-17465Dashboards and progressiveProfileForms in ForgeRock Identity…6.1
• CVE-2020-17466Turcom TRCwifiZone through 2020-08-10 allows authentication …9.8
• CVE-2020-17467An issue was discovered in FNET through 4.6.4. The code for …9.1
• CVE-2020-17468An issue was discovered in FNET through 4.6.4. The code for …7.5
• CVE-2020-17469An issue was discovered in FNET through 4.6.4. The code for …7.5
• CVE-2020-17470An issue was discovered in FNET through 4.6.4. The code that…5.3
• CVE-2020-17473Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213…5.9
• CVE-2020-17474A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 a…9.8
• CVE-2020-17475Lack of authentication in the network relays used in MEGVII …7.5
• CVE-2020-17476Mibew Messenger before 3.2.7 allows XSS via a crafted user n…6.1
• CVE-2020-17477Incorrect LDAP ACLs in ucs-school-ldap-acls-master in UCS@sc…6.5