TRB-119v1.0.0 · yaml_unsafe_object_tag_detected
YAML unsafe object tag detected
YAML unsafe object tag detected identifies the input can request unsafe object construction during deserialization.
CWE mapping
CWE-502insufficient recognition
Assurance
The analyzer verified the reported construct is present in the supplied input.
Conditional: Impact depends on how the destination parser, runtime, or deployment is configured.
Inert example
Displayed as text only. tryb does not execute this example.
value: !!js/function 'example'Remediation
constrain-parser. Disable ambiguous or dangerous parser modes instead of guessing intent from text.
Verify: Confirm the production parser rejects the construct under its deployed configuration.
What to verify next
Confirm the exact production parser and security settings before treating this as exploitable.