> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Tainted pyyaml

> **tainted-pyyaml**
>
> The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\
> **Likelihood**: MEDIUM\
> **Confidence**: HIGH\
> **CWE**: \
> \- CWE-502: Deserialization of Untrusted Data
> \
> **OWASP**: \
> \- A08:2017 - Insecure Deserialization
> \
> \- A08:2021 - Software and Data Integrity Failures


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.