Data ExporterData3 hops · 5 affected releases
- ApplicationData Exporter
- Hop 1declared · dev · ^5.6.5pytest5.6.5
- Hop 2transitive · ^5.10.4attrs5.10.4
- Faulttransitive · >=5.1.0 <6.0.0pyyaml5.1.4
Drawing the sheet
USY-2026-0120 · Deserialization of untrusted data · score 9.8
A document tag routed through the default loader instantiates arbitrary Python objects. Any code path that parses a user-supplied YAML document is affected.
SyntheticThis advisory is invented for the demonstration. pyyaml is a real package; nothing described here has been reported against it.
Every exposed application reaches this on a route of its own: no intermediate package is shared by more than one path. There is no single change here; each application has to move separately, or the ecosystem has to move first.
Fraud Scoring
Reporting Pipeline
Data Exporter
Reporting Pipeline
Data Exporter
Fraud Scoring
Affected. Fixed in 6.0.1.