YAML Security Risks You Should Know
This one's less about syntax and more about something worth knowing if you write code that reads YAML files, rather than just config files you write by hand: parsing YAML the wrong way can be a genuine security risk.
The core issue: unsafe loading
Some YAML libraries support tags that can construct arbitrary objects, not just plain strings, numbers, and lists — including, in some languages, objects that execute code when they're created. If your program loads YAML from an untrusted source (a user upload, an API request body, a file from outside your organization) using an "unsafe" or "full" load function, a maliciously crafted YAML file can potentially execute code on your server the moment it's parsed.
This isn't theoretical — it's a well-documented class of vulnerability across multiple languages' YAML libraries, and it's shown up in real CVEs over the years, usually in libraries that defaulted to the more powerful, less safe loading mode.
The fix is almost always one function call
Nearly every mainstream YAML library provides a "safe load" function specifically for this reason — one that only ever produces plain data (strings, numbers, booleans, lists, maps) and refuses to construct arbitrary types. In Python's PyYAML, that's the difference between yaml.load() and yaml.safe_load(). In most other languages, look for a similarly named "safe" variant.
A simple rule
- If the YAML comes from a source you fully control and trust (your own config files, checked into your own repo), the risk is low either way.
- If the YAML comes from anywhere outside your direct control — an upload, an API, a third-party plugin — always use the safe-loading function, no exceptions.
This is worth knowing even if you never write YAML-parsing code yourself, because it's a good reason to be a little careful about which online tools you paste sensitive YAML into in the first place. Our formatter parses everything in your own browser using safe parsing rules, and never sends your file anywhere else to be processed.