CVE-2020-10289

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib, an attacker with local or remote access can make the ROS Master, execute arbitrary code in Python form. Consider yaml.safe_load() instead. Located first in actionlib/tools/library.py:132. See links for more info on the bug.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Aug 20, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-10297.8An elevation of privilege vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations, aka CVE-2020-102906.8Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide A CVE-2020-102917.5Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decisio CVE-2020-102928.2Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decisio CVE-2020-10307.8<p>An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file sys CVE-2020-10317.5<p>An information disclosure vulnerability exists in the way that the Windows Server DHCP service improperly discloses the contents of its m CVE-2020-10329.0A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authentica CVE-2020-10334.0<p>An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully CVE-2020-10346.8<p>An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully CVE-2020-10357.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt CVE-2020-10369.0A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authentica CVE-2020-103647.5The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized