cleveragents/cleveragents-core
4
0
Fork 3
Code Issues 6.0k Pull Requests 115 Actions Packages Projects Releases Wiki Activity

chore(deps): upgrade PyYAML to address known security vulnerability

Browse Source 
Added explicit pyyaml>=6.0.3 constraint to pyproject.toml to address
CVE-2017-18342 and related advisories. A codebase-wide audit confirmed
all YAML loading uses yaml.safe_load() exclusively via
cleveragents.actor.yaml_loader. Added BDD regression scenarios in
features/pyyaml_security.feature to verify the version constraint and
safe-load enforcement are maintained. Updated CHANGELOG.md with a
security entry.

ISSUES CLOSED: #9055
This commit is contained in:
HAL 9000
2026-04-28 07:07:51 +00:00
committed by Forgejo
parent 3291ea62ee
commit 850d430c48
4 changed files with 107 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
features/pyyaml_security.feature
+18
View File
@@ -0,0 +1,18 @@
Feature: PyYAML security constraint
Verify that PyYAML is pinned to a secure version and that all YAML loading
in the codebase uses safe_load to prevent arbitrary code execution.
See issue #9055: CVE-2017-18342 mitigation.
Scenario: PyYAML version meets the minimum secure version constraint
Given the PyYAML package is installed
When I check the installed PyYAML version
Then the version should be at least 6.0.3
Scenario: yaml_loader uses safe_load for plain YAML input
When I call load_yaml_text with YAML text "provider: anthropic\nmodel: claude-3-5-sonnet\n"
Then the load_yaml_text result should have key "provider" equal to "anthropic"
And the load_yaml_text result should have key "model" equal to "claude-3-5-sonnet"
Scenario: yaml_loader rejects YAML with Python object tags
When I call load_yaml_text with unsafe YAML containing a Python object tag
Then a ValueError should be raised