description: In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalling untrusted data can lead to security flaws of RCE.
problem types: Remote Code Execution
affected:
{
product: Apache ShardingSphere(incubator)
vendor: Apache Software Foundation
versions:
status: affected, version: 4.0.0-RC3
status: affected, version: 4.0.0
}