CVE-2017-20285: Perl YAML Privilege Escalation Vulnerability

CVE-2017-20285 Overview

CVE-2017-20285 affects the Perl YAML module in versions before 1.30. A loaded YAML document can trigger the DESTROY method of arbitrary Perl classes already loaded in the process. The flaw stems from unsafe handling of the perl/hash:Class tag, which blesses a hash into the named class. When Perl garbage-collects the resulting object, it invokes that class's DESTROY method with attacker-controlled fields.

Using File::Temp::Dir from core Perl, an attacker can delete a directory tree named by the document. The weakness is classified as [CWE-470] Use of Externally-Controlled Input to Select Classes or Code.

Critical Impact
Processing untrusted YAML with the Perl YAML module can lead to arbitrary class instantiation and destructor-driven filesystem operations, including recursive directory deletion.

Affected Products

Perl YAML module (CPAN distribution YAML) versions prior to 1.30
Applications and scripts loading untrusted YAML via YAML::Load or YAML::LoadFile
Downstream Perl distributions bundling vulnerable YAML releases

Discovery Timeline

2026-10-05 - CVE-2017-20285 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2017-20285

Vulnerability Analysis

The Perl YAML module supports type tags such as !perl/hash:Foo::Bar, which instruct the loader to bless a parsed hash into the named Perl class. The loader performs this blessing without validating the target class or restricting it to a safe allowlist. Once blessed, the object is a normal Perl instance of that class, and standard Perl semantics apply.

When the blessed object leaves scope, Perl invokes the class's DESTROY method if one exists. The behavior of that destructor depends on which modules the process has loaded. The published impact example uses File::Temp::Dir, whose DESTROY method removes a directory tree pointed to by the object's fields. Because the YAML document supplies those fields, an attacker controls the path passed to the destructor.

Root Cause

The root cause is unsafe deserialization. The loader treats perl/hash:Class tags as a bless directive on every load without an opt-in. Before version 1.25, no mechanism existed to disable this. Between 1.25 and 1.29, the $YAML::LoadBlessed variable existed but defaulted to 1 (true), preserving the insecure behavior.

Attack Vector

An attacker crafts a YAML document containing a perl/hash:File::Temp::Dir tag whose fields reference a sensitive directory. A Perl application that loads the document with a vulnerable YAML module blesses the hash into File::Temp::Dir. When the object is reaped, the destructor removes the referenced directory tree. Any class with a side-effect-bearing DESTROY method loaded in the process can be abused in the same way.

text

# Patch excerpt from lib/YAML.pm (commit 471314bb) — introduces $LoadBlessed
    $UseHeader, $UseVersion, $UseBlock, $UseFold, $UseAliases,
    $Indent, $SortKeys, $Preserve,
    $AnchorPrefix, $CompressSeries, $InlineSeries, $Purity,
-    $Stringify, $Numify
+    $Stringify, $Numify, $LoadBlessed,
);

+$LoadBlessed = 1;
+

use YAML::Node; # XXX This is a temp fix for Module::Build
use Scalar::Util qw/ openhandle /;

Source: GitHub commit 471314bb

text

# Patch excerpt from lib/YAML.pm (commit 7736f38b) — changes default to undef
    $DumperClass, $LoaderClass
);

-$LoadBlessed = 1;
-
-
use YAML::Node; # XXX This is a temp fix for Module::Build
use Scalar::Util qw/ openhandle /;

Source: GitHub commit 7736f38b

Detection Methods for CVE-2017-20285

Indicators of Compromise

YAML documents containing perl/hash: tags that reference classes with destructive DESTROY methods, such as File::Temp::Dir.
Unexpected recursive directory deletions by Perl processes that consume YAML input.
Perl applications loading YAML from HTTP endpoints, message queues, or user uploads without LoadBlessed disabled.

Detection Strategies

Inventory installed YAML CPAN module versions across hosts and flag any below 1.30.
Statically scan Perl codebases for calls to YAML::Load, YAML::LoadFile, or Load() from the YAML namespace without a preceding assignment of $YAML::LoadBlessed = 0.
Inspect YAML payloads at ingestion points for !perl/ tag prefixes before passing them to the loader.

Monitoring Recommendations

Alert on Perl interpreter processes performing unlink or rmdir syscalls against directories outside expected working paths.
Audit filesystem telemetry for mass deletions correlated with YAML parsing in web applications and CI tooling.
Track CPAN package upgrades in configuration management to confirm YAML 1.30 or later is deployed.

How to Mitigate CVE-2017-20285

Immediate Actions Required

Upgrade the Perl YAML module to version 1.30 or later on all systems that parse YAML.
Explicitly set $YAML::LoadBlessed = 0 in any code path that loads untrusted YAML, regardless of module version.
Audit third-party Perl applications and tooling for bundled vulnerable copies of the YAML module.

Patch Information

The fix was delivered across two upstream commits. Commit 471314bb introduced the $YAML::LoadBlessed toggle in version 1.25, allowing callers to opt out of blessing tagged nodes. Commit 7736f38b changed the default to undef (false) in version 1.30, making safe behavior the default. See the MetaCPAN YAML 1.30 changelog and the upstream issue #176 discussion for context.

Workarounds

Set $YAML::LoadBlessed = 0 before any YAML::Load or YAML::LoadFile call that handles untrusted input.
Replace the YAML module with a safer loader such as YAML::XS configured with $YAML::XS::LoadBlessed = 0, or YAML::PP with blessing disabled.
Validate and reject YAML documents containing !perl/ tags at the application boundary when blessing cannot be fully disabled.

bash

# Disable blessing of tagged nodes before loading untrusted YAML
perl -e '
  use YAML;
  $YAML::LoadBlessed = 0;
  my $data = YAML::LoadFile("untrusted.yaml");
'

# Upgrade YAML to the fixed release from CPAN
cpanm YAML@1.30