GHSA-gfxp-f68g-8x78

Source

https://github.com/advisories/GHSA-gfxp-f68g-8x78

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-gfxp-f68g-8x78/GHSA-gfxp-f68g-8x78.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-gfxp-f68g-8x78

Published

2025-09-15T13:57:29Z

Modified

2025-09-15T13:57:29Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

LibYML: `libyml::string::yaml_string_extend` is unsound and unmaintained

Details

In version 0.0.4, libyml::string::yaml_string_extend was revised resulting in undefined behaviour, which is unsound.

The GitHub project for libyml was archived after unsoundness issues were raised.

If you rely on this crate, it is highly recommended switching to a maintained alternative.

Recommended alternatives

<code>libyaml-safer</code>
<code>unsafe-libyaml-norway</code> - Maintained fork of unsafe-libyaml

Database specific

{
    "github_reviewed": true,
    "severity": "HIGH",
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-758"
    ],
    "github_reviewed_at": "2025-09-15T13:57:29Z"
}

References

Affected packages

crates.io / libyml

Package

Name: libyml; View open source insights on deps.dev
Purl: pkg:cargo/libyml

Affected ranges

Type: SEMVER
Events: Introduced

0.0.4

Last affected

0.0.5