Critical
ruamel.yaml — security advisory
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.
- Products
- ruamel.yaml
- Affected versions
- 0.10.12-1, 0.10.12-2, 0.10.12-2build1, 0.10.23-1, 0.13.4-2build2, 0.15.34-1, 0.15.34-1build2, 0.15.89-1, 0.15.89-3, 0.15.89-3build1, 0.16.12-2, 0.17.16-1, 0.17.21-1, 0.18.10+ds-1, 0.18.10+ds-1build1, 0.18.14-4
- Fixed versions
- Not specified
- CVEs
- CVE-2019-20478
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 00:50 UTC · Revision 1
Source evidence
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.
osv:UBUNTU-CVE-2019-20478
ruamel.yaml
Fixed versions: Not specified
ruamel.yaml
Fixed versions: Not specified
ruamel.yaml
Fixed versions: Not specified
ruamel.yaml
Fixed versions: Not specified
ruamel.yaml
Fixed versions: Not specified
ruamel.yaml
Fixed versions: Not specified
ruamel.yaml
Fixed versions: Not specified
ruamel.yaml
Fixed versions: Not specified
Complete source record
{
"id": "e3f03baf325bed92d0833c184d648b054306608faef75aa468889bc7dc54c2cd",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2019-20478",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2019-20478",
"summary": "In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.",
"evidence": "osv:UBUNTU-CVE-2019-20478",
"products": [
{
"name": {
"value": "ruamel.yaml",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.10.12-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.10.12-2",
"evidence": "/affected/0/versions"
},
{
"value": "0.10.12-2build1",
"evidence": "/affected/0/versions"
},
{
"value": "0.10.23-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "ruamel.yaml",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.13.4-2build2",
"evidence": "/affected/1/versions"
},
{
"value": "0.15.34-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "ruamel.yaml",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.15.34-1build2",
"evidence": "/affected/2/versions"
},
{
"value": "0.15.89-1",
"evidence": "/affected/2/versions"
},
{
"value": "0.15.89-3",
"evidence": "/affected/2/versions"
},
{
"value": "0.15.89-3build1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "ruamel.yaml",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.16.12-2",
"evidence": "/affected/3/versions"
},
{
"value": "0.17.16-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "ruamel.yaml",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.17.21-1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "ruamel.yaml",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.18.10+ds-1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "ruamel.yaml",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.18.10+ds-1build1",
"evidence": "/affected/6/versions"
},
{
"value": "0.18.14-4",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "ruamel.yaml",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.18.10+ds-1",
"evidence": "/affected/7/versions"
},
{
"value": "0.18.10+ds-1build1",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "critical",
"structured": {
"id": "UBUNTU-CVE-2019-20478",
"aliases": [
"UBUNTU-CVE-2019-20478"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruamel.yaml",
"purl": "pkg:deb/ubuntu/ruamel.yaml?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"0.10.12-1",
"0.10.12-2",
"0.10.12-2build1",
"0.10.23-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-20478.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-ruamel.yaml",
"binary_version": "0.10.23-1"
},
{
"binary_name": "python3-ruamel.yaml",
"binary_version": "0.10.23-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruamel.yaml",
"purl": "pkg:deb/ubuntu/ruamel.yaml?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"0.13.4-2build2",
"0.15.34-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-20478.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-ruamel.yaml",
"binary_version": "0.15.34-1"
},
{
"binary_name": "python3-ruamel.yaml",
"binary_version": "0.15.34-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruamel.yaml",
"purl": "pkg:deb/ubuntu/ruamel.yaml?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"0.15.34-1build2",
"0.15.89-1",
"0.15.89-3",
"0.15.89-3build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-20478.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-ruamel.yaml",
"binary_version": "0.15.89-3build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruamel.yaml",
"purl": "pkg:deb/ubuntu/ruamel.yaml?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"0.16.12-2",
"0.17.16-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-20478.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-ruamel.yaml",
"binary_version": "0.17.16-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruamel.yaml",
"purl": "pkg:deb/ubuntu/ruamel.yaml?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"0.17.21-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-20478.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-ruamel.yaml",
"binary_version": "0.17.21-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruamel.yaml",
"purl": "pkg:deb/ubuntu/ruamel.yaml?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"0.18.10+ds-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-20478.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-ruamel.yaml",
"binary_version": "0.18.10+ds-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruamel.yaml",
"purl": "pkg:deb/ubuntu/ruamel.yaml?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"0.18.10+ds-1build1",
"0.18.14-4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-20478.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-ruamel.yaml",
"binary_version": "0.18.14-4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruamel.yaml",
"purl": "pkg:deb/ubuntu/ruamel.yaml?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"0.18.10+ds-1",
"0.18.10+ds-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-20478.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-ruamel.yaml",
"binary_version": "0.18.10+ds-1build1"
}
]
}
}
],
"modified": "2026-10-17T12:56:07.993444208Z",
"provider": "osv",
"upstream": [
"CVE-2019-20478"
],
"references": [
"https://ubuntu.com/security/CVE-2019-20478",
"https://www.exploit-db.com/exploits/47655",
"https://www.cve.org/CVERecord?id=CVE-2019-20478"
]
},
"related_cves": [
{
"value": "CVE-2019-20478",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 354862,
"published_at": "2020-02-19T04:15:00+00:00"
}