CVE-2022-1471: exploitation status and patch state

CVE-2022-1471 · CVSS 8.3 HIGH · EPSS 99.6%

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.

Is CVE-2022-1471 exploited?

• Not in the CISA KEV catalog.
• EPSS puts exploitation in the next 30 days at 99.6%.
• Public exploit code: packaged in a public tool.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2022-1471

• Node Kernel Bugs on GKE COS Nodes Enable Host Escalation (2026-04-15)
• Google Cloud Issues Multiple Linux Kernel Privilege Escalation Fixes for GKE Nodes (2026-04-07)
• Multiple Linux Kernel Flaws Elevate Privileges on GCP Container Nodes (2026-04-03)
• Multiple High-Severity Cloud Vulnerabilities Impact Container Nodes (2026-04-01)

Primary sources

• NVD record
• Metasploit: exploit/multi/http/torchserver_cve_2023_43654

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-15.