snakeyaml-maven

SnakeYAML in Maven: How to Use It Safely and Avoid CVE-2022-1471

Adding SnakeYAML as a Maven dependency is fine, but parsing untrusted YAML with the default constructor is not. Here is how to pin a safe version and lock down deserialization.