CVE-2017-20285

Critical

Description

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names.

SeverityCritical

CVSS9.1

Exploit probability—

ProductYaml

PublishedOct 5, 2026

First seenOct 5, 2026

Weakness typeCWE-502Deserialization of untrusted data CWE-470CWE-470

How to fix

Update

YAML1.30 or later

Patches

Vendor advisories

metacpan.org/release/TINITA/YAML-1.30/changes

Affected products

Product	Affected versions	Fixed in
YAML	v < 1.30	1.30

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.