VDB
CVE-2019-20478
CVE-2019-20478
PUBLISHED
Reported by mitre · Published February 19, 2020
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| n/a | n/a | * |
Timeline
- Feb 19, 2020 CVE Published
- Apr 14, 2021 EPSS Score (30 in total, the first dated here)
- Jun 2, 2026 Security Advisory
- Sep 12, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2019-20478
vulnetix vdb fixes CVE-2019-20478Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2019-20478/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart