> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Tainted pyyaml pyramid

<AccordionGroup>
  <Accordion title="tainted-pyyaml-pyramid">
    The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) PyYAML's `yaml` module is as powerful as `pickle` and so may call any Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.<br />**Likelihood**: MEDIUM<br />**Confidence**: HIGH<br />**CWE**: <br />- CWE-502: Deserialization of Untrusted Data
    <br />**OWASP**: <br />- A08:2017 - Insecure Deserialization
    <br />- A08:2021 - Software and Data Integrity Failures
  </Accordion>
</AccordionGroup>