CVE-2013-6393: The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, whic...

Security readout for executives and security teams

LibYAML before 0.1.5 can crash, and may allow code execution, when it parses a specially crafted YAML document. Business risk depends on whether systems parse YAML supplied by users, partners, APIs, or automation pipelines. Exposure is most likely in applications, agents, deployment tools, or services that use LibYAML to parse untrusted YAML. Systems only parsing trusted local configuration have lower practical exposure. Prioritize remediation where YAML is accepted from external users or automation inputs. Treat internet-facing or multi-tenant parsers as urgent despite missing CVSS, because the bug is memory corruption with possible code execution. Mitigation focus: Upgrade LibYAML to 0.1.5 or a vendor-patched package.; Apply relevant OS vendor advisories for Debian, Red Hat, openSUSE, Apple, Mageia, or Mandriva.; Inventory bundled or statically linked LibYAML copies in applications..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.