Read the docs
TI-2025-27302 Aliases CVE-2025-40908GHSA-jh9m-3m95-c6hp

YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified

Priority MEDIUM 48CWE-552Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-552.

Summary

YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00472 41st percentileScored 2026-11-08
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed YAML::LibYAML (TINITA): 0.903.0Red Hat: 3 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TINITAYAML::LibYAMLbefore 0.903.00.903.0Patch availableCNA
  • YAML::LibYAML VendorTINITA Affected before 0.903.0 Fixed in 0.903.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ingydotnet:yaml-libyaml:*:*:*:*:*:perl:*:*before 0.903.0VulnerableIngydotnet
  • cpe:2.3:a:ingydotnet:yaml-libyaml:*:*:*:*:*:perl:*:* Versions before 0.903.0 Vulnerable ·Ingydotnet

Remediation

  • Fix · CNA YAML::LibYAML (TINITA) Fixed in 0.903.0

Red Hat 3 advisories

  • RHSA-2025:9338 Released 2025-06-23 · Red Hat rating Important
    perl-YAML-LibYAML security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) perl-YAML-LibYAML-1:0.82-6.el9_4.1
  • RHSA-2025:9329 Released 2025-06-23 · Red Hat rating Important
    perl-YAML-LibYAML security update
    • Red Hat Enterprise Linux CRB (v. 8) perl-YAML-LibYAML-1:0.70-2.el8_10
  • RHSA-2025:9330 Released 2025-06-23 · Red Hat rating Important
    perl-YAML-LibYAML security update
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) perl-YAML-LibYAML-1:0.82-6.1.el9_6

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2025:9338
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2025:9329
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2025:9330

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-40908
  2. 2026-10-03 Alias added: GHSA-jh9m-3m95-c6hp

References

Exploit 1

Patch 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences