[HIGH]2025-09-18CVE Research
CVE-adjacent deserialization in ops tooling
> Unsafe object hydration allowed RCE in a CI helper. Upstream advisory filed.
RCECI/CDDeserialization
A popular CI helper hydrated build metadata via insecure YAML load.
Crafted artifacts triggered gadget chains under default configs.
Upstream patched with safe_load defaults; pin versions until vendors ship.