CVE-2022-1471

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 99.57%
EPSS Percentile: 99.95%
CISA KEV: Not listed

Description

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 01-Dec-2022 18:15
Last Modified: 17-Jun-2026 11:22
EPSS Date: 2026-10-23
CWE: CWE-20, CWE-502

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

snakeyaml_project / snakeyaml
Version / affected range: * · before (exclusive) 2.0
cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:*

References

Last enrichment sync: 24-Oct-2026 21:13
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

On the cluster: 12 CVEs including CVE-2022-1471 (SnakeYAML deserialization, EPSS 0.94), CVE-2024-4577 (PHP-CGI argument injection, EPSS 0.97), CVE-2024-34351 (Next.js SSRF), CVE-2025-29927 (Next.js authentication AWS Adds Five Risk Indicators to GuardDuty Extended Threat Detection

CVE (6)

MITRE ATT&CK (1)

Vendors (1)

Products (8)

Tools (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.