CVE-2022-1471: SnakeYaml Constructor Deserialization Remote Code Execution
Summary
CVE-2022-1471: SnakeYaml Constructor Deserialization Remote Code Execution. Affects org.yaml:snakeyaml versions < 2.0. Fixed in 2.0. How to fix ↓
Also tracked for
- snakeyaml · Debian:11
The same CVE-2022-1471 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SnakeYaml is an open-source Java library for parsing and emitting YAML data. It provides functionality for converting YAML documents into Java objects and vice versa. The library is widely used in various applications and frameworks that deal with YAML data. However, a vulnerability has been discovered in the Constructor class of SnakeYaml, which allows for remote code execution. This vulnerability arises from a lack of type checks during deserialization, enabling an attacker to execute arbitrary code on the target system.
Vulnerability Detail
The vulnerability in SnakeYaml's Constructor class allows any type to be deserialized, regardless of whether it matches the types of properties in the target class. This lack of type checks opens the door for remote code execution. An attacker can craft a malicious payload and deserialize it using the Constructor class, leading to the execution of arbitrary code on the target system. Although a ConstructorException is thrown, it occurs only after the payload has been deserialized, allowing the attacker to achieve remote code execution. The severity of this vulnerability is rated as high due to the potential for unauthorized code execution.
How To Fix
Latest published version: 2.7 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of SnakeYaml is not immediately feasible, a workaround can be implemented by leveraging SnakeYaml's SafeConstructor while parsing untrusted content. The SafeConstructor provides additional security measures by restricting the types that can be deserialized. By using the SafeConstructor, applications can reduce the risk of deserializing malicious payloads and prevent remote code execution.
Conclusion
The SnakeYaml Constructor Deserialization Remote Code Execution vulnerability poses a significant risk to applications using versions prior to 2.0 of the SnakeYaml library. To mitigate this vulnerability, it is crucial to upgrade to the latest version or implement the recommended workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.yaml:snakeyaml →
FAQ
SnakeYaml is an open-source Java library for parsing and emitting YAML data. It allows developers to convert YAML documents into Java objects and vice versa.
The vulnerability in SnakeYaml's Constructor class allows for remote code execution. An attacker can exploit this vulnerability to execute arbitrary code on the target system.
To fix this vulnerability, it is recommended to upgrade to version 2.0 or later of the SnakeYaml library. This version includes the necessary fixes to prevent remote code execution.
Yes, if upgrading to the latest version is not immediately feasible, you can implement a workaround by using SnakeYaml's SafeConstructor while parsing untrusted content. The SafeConstructor provides additional security measures to mitigate the risk of remote code execution.
Yes, the CVSS score for this vulnerability is 8.3, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.yaml:snakeyaml.
