WaratekVRT Sign in

CVE-2020-14343 PyYAML

Affected softwarePyYAML
Severity9.8 Critical CVSS 3.1 2 scores
WeaknessImproper input validation (CWE-20)
Published9 Feb 2021
Updated17 Jun 2026

Description

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. The 2 repositories below are public GitHub repositories with fewer than 5 stars.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 2 indexed, none at 5+ stars
  • EPSS 6.2% chance in 30 days

2 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC A web application vulnerable to CVE-2020-14343 insecure deserialization leading to command execution in PyYAML package. 3 2022-04-19
GitHub PoC Controlled vulnerability research and reproduction lab for CVE-2020-14343 in PyYAML 2026-09-19

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 10.0 none AV:N/AC:L/Au:N/C:C/I:C/A:C NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2023 ↗ CPU 2023-Q2 Oracle PeopleSoft / Porting (PyYAML) (8.58, 8.59)
Oracle Critical Patch Update July 2022 ↗ CPU 2022-Q3 Oracle Communications / CNE (PyYAML) (22.1.0)
Oracle Critical Patch Update April 2022 ↗ CPU 2022-Q2 Oracle Communications / OC-CNE (PyYAML) (1.10.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications CNE (PyYAML) 22.1.0 22.1.0
Oracle Communications OC-CNE (PyYAML) 1.10.0 1.10.0
Oracle PeopleSoft Porting (PyYAML) 8.58, 8.59 8.58 · 8.59

Products and versions

2 products, 3 version entries
SourceVendorProductSchemeAffected versions
nvd oracle communications cloud native core network function cloud native environment generic 1.10.0 · 22.1.0
nvd pyyaml pyyaml generic ≥ 5.1 and ＜ 5.4

References

URLTags
https://bugzilla.redhat.com/show_bug.cgi?id=1860466 Issue Tracking, Third Party Advisory
https://github.com/SeldonIO/seldon-core/issues/2252
https://github.com/yaml/pyyaml/issues/420
https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory

Timeline
Published2021-02-09By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.