YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names.

zetlyn/cve-nvd vulnerability cve CVE-2017-20285 known 2026-10-05

https://nvd.nist.gov/vuln/detail/CVE-2017-20285

Properties

cwe

CWE-470, CWE-502

receipt

Source: NVD
Its words: CWE-470, CWE-502
Read by: field:cve.weaknesses[].description[].value
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	CWE-470, CWE-502
2026-10-05 12:23 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://cpan.org/modules",
            "defaultStatus": "unaffected",
            "modules": [
              "YAML"
            ],
            "packageName": "YAML",
            "packageURL": "pkg:cpan/YAML",
            "programFiles": [
              "lib/YAML.pm",
              "lib/YAML/Loader.pm",
              "lib/YAML/Types.pm"
            ],
            "programRoutines": [
              {
                "name": "YAML::Loader::_parse_explicit"
              },
              {
                "name": "YAML::Type::code::yaml_load"
              },
              {
                "name": "YAML::Type::regexp::yaml_load"
              }
            ],
            "repo": "https://github.com/ingydotnet/yaml-pm",
            "versions": [
              {
                "lessThan": "1.30",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.\n\nA perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope.\n\nWhat DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names."
      }
    ],
    "id": "CVE-2017-20285",
    "lastModified": "2026-10-05T19:17:10.910",
    "metrics": {},
    "published": "2026-10-05T07:16:29.017",
    "references": [
      {
        "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "url": "https://github.com/ingydotnet/yaml-pm/commit/471314bbdcbd62077eea32755929122aa8bd00a3.patch"
      },
      {
        "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "url": "https://github.com/ingydotnet/yaml-pm/commit/7736f38bd02e4f9f77d5468721e3be3d7b34a8ec.patch"
      },
      {
        "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "url": "https://github.com/ingydotnet/yaml-pm/issues/176"
      },
      {
        "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "url": "https://metacpan.org/release/TINITA/YAML-1.30/changes"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "http://www.openwall.com/lists/oss-security/2026/10/05/8"
      }
    ],
    "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-470"
          },
          {
            "lang": "en",
            "value": "CWE-502"
          }
        ],
        "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "type": "Secondary"
      }
    ]
  }
}

fixed_in

1.30

receipt

Source: NVD
Its words: 1.30
Read by: field:cve.affected[].affectedData[].versions[status=affected].lessThan
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	1.30
2026-10-05 12:23 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://cpan.org/modules",
            "defaultStatus": "unaffected",
            "modules": [
              "YAML"
            ],
            "packageName": "YAML",
            "packageURL": "pkg:cpan/YAML",
            "programFiles": [
              "lib/YAML.pm",
              "lib/YAML/Loader.pm",
              "lib/YAML/Types.pm"
            ],
            "programRoutines": [
              {
                "name": "YAML::Loader::_parse_explicit"
              },
              {
                "name": "YAML::Type::code::yaml_load"
              },
              {
                "name": "YAML::Type::regexp::yaml_load"
              }
            ],
            "repo": "https://github.com/ingydotnet/yaml-pm",
            "versions": [
              {
                "lessThan": "1.30",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.\n\nA perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope.\n\nWhat DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names."
      }
    ],
    "id": "CVE-2017-20285",
    "lastModified": "2026-10-05T19:17:10.910",
    "metrics": {},
    "published": "2026-10-05T07:16:29.017",
    "references": [
      {
        "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "url": "https://github.com/ingydotnet/yaml-pm/commit/471314bbdcbd62077eea32755929122aa8bd00a3.patch"
      },
      {
        "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "url": "https://github.com/ingydotnet/yaml-pm/commit/7736f38bd02e4f9f77d5468721e3be3d7b34a8ec.patch"
      },
      {
        "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "url": "https://github.com/ingydotnet/yaml-pm/issues/176"
      },
      {
        "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "url": "https://metacpan.org/release/TINITA/YAML-1.30/changes"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "http://www.openwall.com/lists/oss-security/2026/10/05/8"
      }
    ],
    "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-470"
          },
          {
            "lang": "en",
            "value": "CWE-502"
          }
        ],
        "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "type": "Secondary"
      }
    ]
  }
}

status

Received

receipt

Source: NVD
Its words: Received
Read by: field:cve.vulnStatus
Said since: 2026-10-05 12:23 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://cpan.org/modules",
            "defaultStatus": "unaffected",
            "modules": [
              "YAML"
            ],
            "packageName": "YAML",
            "packageURL": "pkg:cpan/YAML",
            "programFiles": [
              "lib/YAML.pm",
              "lib/YAML/Loader.pm",
              "lib/YAML/Types.pm"
            ],
            "programRoutines": [
              {
                "name": "YAML::Loader::_parse_explicit"
              },
              {
                "name": "YAML::Type::code::yaml_load"
              },
              {
                "name": "YAML::Type::regexp::yaml_load"
              }
            ],
            "repo": "https://github.com/ingydotnet/yaml-pm",
            "versions": [
              {
                "lessThan": "1.30",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.\n\nA perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope.\n\nWhat DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names."
      }
    ],
    "id": "CVE-2017-20285",
    "lastModified": "2026-10-05T19:17:10.910",
    "metrics": {},
    "published": "2026-10-05T07:16:29.017",
    "references": [
      {
        "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "url": "https://github.com/ingydotnet/yaml-pm/commit/471314bbdcbd62077eea32755929122aa8bd00a3.patch"
      },
      {
        "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "url": "https://github.com/ingydotnet/yaml-pm/commit/7736f38bd02e4f9f77d5468721e3be3d7b34a8ec.patch"
      },
      {
        "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "url": "https://github.com/ingydotnet/yaml-pm/issues/176"
      },
      {
        "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "url": "https://metacpan.org/release/TINITA/YAML-1.30/changes"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "http://www.openwall.com/lists/oss-security/2026/10/05/8"
      }
    ],
    "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-470"
          },
          {
            "lang": "en",
            "value": "CWE-502"
          }
        ],
        "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "type": "Secondary"
      }
    ]
  }
}

Text

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names.