YAML-LibYAML for Perl Two-Argument Open Vulnerability Allowing File Modification

A vulnerability exists in YAML-LibYAML for Perl, in versions prior to 0.903.0, where the 'LoadFile' function uses a two-argument open. This behavior allows existing files to be truncated and modified, potentially leading to data loss.

Impact

Exploitation of this vulnerability can result in unintended modification of files, specifically truncating their contents.

Reproduction

The vulnerability can be reproduced by using the 'LoadFile' function with a filename that includes a write directive, such as '>' followed by a filename. This will overwrite and truncate the specified file. After the 'LoadFile' call, the file will be modified, demonstrating the vulnerability.

Remediation

Users can update to YAML-LibYAML version 0.903.0 or later, where this vulnerability has been addressed.