YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of Deserializer.Deserialize() will deserialize user-controlled types in the line "currentType = Type.…
CVSS 3.0HIGH 7.8·Local·No auth·User interaction·EPSS 0.01469·Published 2018-07-13·Fixed in 5.0.0CWE-502