CVE-2018-20133: Code injection in ymlref

December 19, 2018 (updated November 19, 2024)

ymlref is a library that allows to load Yaml documents and resolve JSON-pointer references inside them. ymlref versions up to 0.1.1 allow code injection.

References

github.com/advisories/GHSA-8r8j-xvfj-36f9
github.com/dexter2206/ymlref
github.com/dexter2206/ymlref/issues/2
github.com/pypa/advisory-database/tree/main/vulns/ymlref/PYSEC-2018-103.yaml
nvd.nist.gov/vuln/detail/CVE-2018-20133

Code Behaviors & Features

Detect and mitigate CVE-2018-20133 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →