Application Security
YAML Deserialization Attacks: The Config File That Runs Code
YAML's type system allows object instantiation during parsing. In many languages, this means a YAML file can execute arbitrary code.
Feb 18, 20264 min read
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
YAML's type system allows object instantiation during parsing. In many languages, this means a YAML file can execute arbitrary code.
YAML looks innocent but its deserialization features have led to remote code execution in countless applications. Here is why and how to stay safe.
Weekly insights on software supply chain security, delivered to your inbox.