praekelt/vumi — Issue #111: yaml.load() allows arbitrary code execution
Author: piet-praekelt
Created: 2012-01-09 08:31:21+00:00
State: open

Via Simon de Haan:

`yaml.load()` allows YAML files to execute arbitrary Python code using the [Python tag scheme](http://pyyaml.org/wiki/PythonTagScheme), e.g.:

```
yaml.load('!!python/object/apply:os.system ["..."]')
```

All `yaml.load()` calls should at least be replaced with `yaml.safe_load()`, which disallow this.