ChainRed Hat · PyYAMLPyPI:PyYAML
Red Hat PyYAML: incomplete fixes (2017–2026)
6 CVEs over 4 generations, 27 Jun 2018 to 22 Jan 2026.
Family tree
Left to right by publication date.Oldest first. Select a CVE to open it.- CVE-2017-1834227 Jun 2018 First in the chain
- CVE-2019-2047719 Feb 2020 incomplete fix for CVE-2017-18342
- CVE-2020-174724 Mar 2020 related to CVE-2017-18342next fix after CVE-2019-20477
- CVE-2020-143439 Feb 2021 incomplete fix for CVE-2020-1747
- CVE-2025-504601 Aug 2025 related to CVE-2020-1747
- CVE-2026-2400922 Jan 2026 related to CVE-2020-14343
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
CVEs in this family
Table view of the tree| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2017-18342 | 27 Jun 2018 | In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data | First in chain | 18.6 |
| CVE-2019-20477 | 19 Feb 2020 | PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class… · fixed in 5.2 | CVE-2017-18342 · incomplete fix · High | 18.5 |
| CVE-2020-1747 | 24 Mar 2020 | A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary… · fixed in 5.3.1 | CVE-2017-18342 · related · Medium | 25.4 |
| CVE-2020-14343 | 9 Feb 2021 | A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code… | CVE-2020-1747 · incomplete fix · High | 23.7 |
| CVE-2025-50460 | 1 Aug 2025 | A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization… | CVE-2020-1747 · related · High | 29.0 |
| CVE-2026-24009 | 22 Jan 2026 | Docling Core vulnerable to Remote Code Execution via unsafe PyYAML usage · fixed in 2.48.4 | CVE-2020-14343 · related · High | 25.6 |