Read the docs
TI-2019-16191 Aliases CVE-2019-25777GHSA-38xx-2hm6-vh7q

Perl YAML loads crafted glob documents that run arbitrary code

Priority LOW 38CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-502.

Summary

YAML for Perl before 1.27_001 lets a loaded perl/glob document replace any package variable (CWE-502). A document can set the YAML load options, which turns on code loading for later Load() calls in the same process. An unauthenticated remote attacker who supplies two documents to separate Load() calls can execute arbitrary Perl code.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options. A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00352 29th percentileScored 2026-11-07
Fix Partial YAML: 1.27_001Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—YAMLbefore 1.27_0011.27_001Patch availableCNA
  • YAML Vendor— Affected before 1.27_001 Fixed in 1.27_001 Patch available CNA

Remediation

Upgrade YAML for Perl to 1.27_001 or later. Red Hat fixes this in RHSA-2026:93471 for Red Hat Enterprise Linux AppStream (v. 8). The sources list no fixed version for Red Hat Enterprise Linux 7.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA YAML Fixed in 1.27_001

Red Hat 1 advisory

  • RHSA-2026:93471 Released 2026-11-02 · Red Hat rating Important
    perl-YAML:1.24 security update
    • Red Hat Enterprise Linux AppStream (v. 8) perl-YAML-1.24-4.module+el8.10.0+25073+42d87e53.noarch::perl-YAML:1.24, perl-YAML-1.24-4.module+el8.10.0+25073+42d87e53.src::perl-YAML:1.24, perl-YAML-1.24-4.module+el8.10.0+25073+d1062575.noarch::perl-YAML:1.24 +1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:93471
Not affected: 3 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-05 Threatist record created from CVE-2019-25777
  2. 2026-10-05 Alias added: GHSA-38xx-2hm6-vh7q
  3. 2026-10-05 Affected versions changed · Red Hat
  4. 2026-10-05 CVSS score added · Red Hat
  5. 2026-10-06 Affected versions changed · Red Hat
  6. 2026-10-06 CVSS score added · CISA ADP
  7. 2026-10-06 CISA SSVC decision points changed
  8. 2026-10-21 Affected versions changed · Red Hat
  9. 2026-11-02 Fix available: RHSA-2026:93471 · Red Hat
  10. 2026-11-02 Fix available: Red Hat Enterprise Linux AppStream (v. 8) · Red Hat

References

Patch 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences