YAML-LibYAML: Shell injection

YAML-LibYAML: Shell injection A vulnerability has been discovered in YAML-LibYAML, which can lead to shell injection. YAML-LibYAML 2025-06-12 2025-06-12 949498 local and remote 0.903.0 0.903.0

YAML-LibYAML provides YAML Serialization using XS and libyaml for Perl.

YAML-LibYAML uses the legacy '2-arg' open() call which is susceptible to shell injection via malicious filenames.

Shell injection may be used to execute arbitrary code using a malicious filename.

There is no known workaround at this time.

All YAML-LibYAML users should upgrade to the latest version:


          # emerge --sync
          # emerge --ask --oneshot --verbose ">=dev-perl/YAML-LibYAML-0.903.0"

CVE-2025-40908 sam graaff