StackPrism

PyPI package

PyYAML vulnerabilities by version

The latest release, 6.0.3 (Sep 25, 2025), has no known vulnerabilities. 4 of the 10 most recent releases have known vulnerabilities. OSV.dev lists 4 advisories for PyYAML; the newest was published on Apr 20, 2021.

PyPI (opens in a new tab) describes it as “YAML parser and emitter for Python”

Latest release
6.0.3
Sep 25, 2025, no known vulnerabilities
Downloads last week
253.2M
All versions, from pypistats.org
Advisories on OSV.dev
4
Newest Apr 20, 2021
Licence
MIT
OpenSSF Scorecard
4.8/10
yaml/pyyaml (opens in a new tab)

Recent releases

PyPI doesn’t publish downloads per version, so these are the newest releases, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilities
6.0.3latestSep 25, 2025No known vulnerabilities
6.0.2Aug 6, 2024No known vulnerabilities
6.0.1Aug 28, 2023No known vulnerabilities
6.0.0Sep 13, 2022No known vulnerabilities
5.4.1Jan 20, 2021No known vulnerabilities
5.4.0Jan 19, 2021No known vulnerabilities
5.3.1Mar 18, 20201 known vulnerability, worst rated critical
5.3.0Jan 6, 20202 known vulnerabilities, worst rated critical
5.2.0Dec 2, 20192 known vulnerabilities, worst rated critical
5.1.2Jul 31, 20193 known vulnerabilities, worst rated critical

Release lines

The newest release of each minor line, from the registry. PyYAML doesn’t publish support dates we can check.

LineNewest releaseReleased
6.06.0.3Sep 25, 2025
5.45.4.1Jan 20, 2021
5.35.3.1Mar 18, 2020
5.25.2.0Dec 2, 2019
5.15.1.2Jul 31, 2019
3.133.13.0Jul 5, 2018

Newest advisories

The 4 most recently published, with the versions each one affects.

  1. CriticalCVE-2019-20477 on OSV.dev (opens in a new tab)GHSA-3pqx-4fqf-j49f

    Deserialization of Untrusted Data in PyYAML

    Affects >= 5.1, < 5.2. Published Apr 20, 2021.

  2. CriticalCVE-2020-1747 on OSV.dev (opens in a new tab)GHSA-6757-jp84-gxfx

    Improper Input Validation in PyYAML

    Affects >= 5.1b7, < 5.3.1. Published Apr 20, 2021.

  3. CriticalCVE-2020-14343 on OSV.dev (opens in a new tab)GHSA-8q59-q68h-6hv4

    Improper Input Validation in PyYAML

    Affects < 5.4. Published Mar 25, 2021.

  4. CriticalCVE-2017-18342 on OSV.dev (opens in a new tab)GHSA-rprw-h62v-c2w7

    PyYAML insecurely deserializes YAML strings leading to arbitrary code execution

    Affects < 5.1. Published Jan 4, 2019.

Which PyYAML do you have?

Paste a public GitHub repo or drop your requirements.txt or pyproject.toml and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for PyYAML, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from pypistats.org. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, PyPI, pypistats.org and deps.dev.