yaml

• Ruby unsafe deserialization — `Marshal.load` / `YAML.load` 2026-04-26
• PyYAML `yaml.load` without a safe Loader 2026-04-25