crates.io libyml vulnerabilities

Latest crates.io libyml CVEs

Newest publication first

1. GHSA-gfxp-f68g-8x78 LibYML: `libyml::string::yaml_string_extend` is unsound and unmaintained

   Published 2025-09-15

   High·CVSS 8.7

   In version 0.0.4, libyml::string::yaml_string_extend was revised resulting in undefined behaviour, which is unsound. The GitHub project for libyml was archived after unsoundness issues were raised. If you rely on this crate, it is highly recommended switching to a maintained alte...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.