{"id":"DEBIAN-CVE-2019-25777","details":"YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.  A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.  A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.","modified":"2026-10-06T05:00:04.169066537Z","published":"2026-10-05T07:16:29.557Z","upstream":["CVE-2019-25777"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2019-25777"}],"affected":[{"package":{"name":"libyaml-perl","ecosystem":"Debian:12","purl":"pkg:deb/debian/libyaml-perl?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2019-25777.json"}},{"package":{"name":"libyaml-perl","ecosystem":"Debian:13","purl":"pkg:deb/debian/libyaml-perl?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2019-25777.json"}},{"package":{"name":"libyaml-perl","ecosystem":"Debian:14","purl":"pkg:deb/debian/libyaml-perl?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2019-25777.json"}}],"schema_version":"1.9.0"}