Perl YAML Deserialization Enables Arbitrary Code Execution

YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options. A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.

Casky was already ahead

This CVE exploits attack patterns that Casky's 447matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2019-25777 exploits unsafe deserialization in the Perl YAML module versions before 1.27_001, allowing attackers to execute arbitrary code by manipulating YAML documents. The vulnerability stems from inadequate restrictions on package variable assignment during YAML parsing—specifically, malicious perl/glob documents can modify critical variables like @INC (Perl's module search path) or YAML's own configuration flags ($YAML::LoadCode, $YAML::UseCode). By enabling code loading through these manipulated variables, attackers can trigger execution of embedded perl/code documents that would normally be restricted. This affects any Perl application parsing untrusted YAML input, particularly those in data processing pipelines, configuration management systems, or services handling user-supplied YAML files.

Casky's 447 mapped skills detect the attack progression across three MITRE ATT&CK phases: Initial Access (TA0001) recognizes delivery of malicious YAML payloads, Execution (TA0002) identifies suspicious Perl code instantiation and module loading anomalies, and Persistence (TA0043) flags unauthorized modification of package variables and configuration state changes. Practitioners using Casky would observe detections for unsafe deserialization patterns, unexpected modifications to @INC or YAML internal flags, and activation of code execution features that should remain disabled. Extended reasoning across these skills correlates YAML parsing events with subsequent Perl interpreter behavior, revealing the chain from document ingestion through code execution—enabling teams to isolate compromised YAML sources and block malicious input before deserialization occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

447 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2019-25777.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2019-25777

Casky has 447 skills that investigate the attack patterns behind CVE-2019-25777. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn