fixed YAML remote code execution vulnerability