Will It Vibe?yaml.load without a safe loader (Python)
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
yaml.load without Loader=SafeLoader can instantiate arbitrary Python objects, which is remote code execution on older PyYAML. Use yaml.safe_load.
Why it matters
yaml.load without a safe loader can construct arbitrary Python objects from tags in the document, which is remote code execution on PyYAML before 5.1 and unsafe on any version when the loader allows it. safe_load restricts parsing to basic types.
How to fix it
Use yaml.safe_load for any input you did not author. If you call yaml.load directly, pass Loader=yaml.SafeLoader explicitly. Reserve the full loader for trusted, internal documents only.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo