CVE-2019-25777: 
Linux Debian vulnerability analysis and mitigation

CVE-2019-25777 is an arbitrary code execution vulnerability in the YAML module for Perl (perl-yaml) affecting all versions before 1.27_001. The flaw allows a loaded perl/glob document to replace any package variable without restriction, enabling an attacker to enable code loading and subsequently execute arbitrary Perl code. The vulnerability was originally discovered and fixed in April 2019, but a CVE number was not reserved until September 2026 and formally published in October 2026. It carries a CVSS v3.1 base score of 7.3 (High) (Github Advisory, Red Hat).

The root cause is classified under CWE-502 (Deserialization of Untrusted Data) and CWE-914 (Improper Control of Dynamically-Identified Variables). When the YAML module processes a perl/glob document, it assigns values to arbitrary package variables — including $YAML::LoadCode or $YAML::UseCode — without checking whether code loading is permitted. By supplying a first YAML document that sets one of these variables to a truthy value, an attacker enables code loading for the entire process; a subsequent perl/code document passed to any Load() call in the same process is then evaluated via Perl's string eval, achieving arbitrary code execution. The fix, committed on April 27, 2019, gates glob loading behind the $loader->load_code check in lib/YAML/Types.pm (GitHub Issue, Commit Patch, oss-security).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary Perl code with the privileges of the application process that calls YAML::Load(). This can result in full compromise of the affected application, including unauthorized data access (confidentiality), data modification (integrity), and service disruption (availability). Because the attack operates within the application process, it may also facilitate lateral movement to other systems or services accessible from the compromised host (Red Hat Bugzilla, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is automatable (no user interaction required) and requires no authentication, but exploitation depends on an attacker being able to supply two separate YAML documents to distinct Load() calls within the same process. The EPSS score is approximately 0.22–0.34%, placing it in the lower percentiles for near-term exploitation likelihood (Github Advisory). The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Identify target: Locate a Perl application that uses the YAML module (versions before 1.27_001) and accepts untrusted YAML input via multiple Load() calls within the same process.
2. Craft first payload (glob document): Construct a YAML document using the perl/glob tag that sets $YAML::LoadCode or $YAML::UseCode to 1, enabling code loading for the process:

--- !!perl/glob
PACKAGE: YAML
NAME: LoadCode
SCALAR: 1

3. Submit first document: Supply this document to the application so it is processed by a YAML::Load() call, silently enabling code execution for all subsequent loads in the process.
4. Craft second payload (code document): Construct a perl/code YAML document containing the arbitrary Perl code to execute:

--- !!perl/code
'system("id"); 1'

5. Submit second document: Supply this document to a subsequent YAML::Load() call in the same process; the code is passed to string eval and executed with the application's privileges (GitHub Issue, oss-security).

• Logs: Application logs showing YAML parsing of documents containing !!perl/glob or !!perl/code tags from untrusted input sources; unexpected Perl eval errors or warnings in application logs.
• Process: Unusual child processes spawned by the Perl application process (e.g., shell commands, network utilities like curl, wget, or nc) that are inconsistent with normal application behavior.
• File System: Unexpected new files, scripts, or web shells created by the application process user; modifications to Perl library files or application configuration.
• Network: Unexpected outbound connections from the application server to external IPs, particularly on non-standard ports, originating from the Perl application process.

Upgrade the Perl YAML module to version 1.28 or later (which includes the fix first released in 1.27_001 on April 27, 2019). As an immediate workaround for deployments that cannot upgrade, set $YAML::LoadBlessed = 0 before processing any untrusted YAML input; this option, available since YAML 1.25, gates glob loading and prevents the exploit chain. Additionally, implement input validation to reject YAML documents containing perl/glob or perl/code tags from untrusted sources (oss-security, Red Hat Bugzilla).

The vulnerability was disclosed to the oss-security mailing list in October 2026 by Stig Palmquist on behalf of the CPAN Security Group, noting the original fix had been available since April 2019 but lacked a formal CVE assignment for over seven years (oss-security). Red Hat triaged the issue as high severity and opened a tracking bug, while Ubuntu issued security notice USN-8925-1 addressing the vulnerability in the yaml/libyaml packages. Community discussion on Bluesky and security aggregators noted the long gap between the original fix and CVE assignment as a common challenge in open-source ecosystem vulnerability management.