How severe is yaml deserialization with yaml.load (unsafe)?

Shield rates this high (CVSS 8.1), classified as CWE-502.

Rules / Python

SHIELD-PY-013

YAML deserialization with yaml.load (unsafe)

highPythonCWE-502CVSS 8.1

yaml.load() without Loader can deserialize arbitrary Python objects.

Use yaml.safe_load() instead of yaml.load() to prevent arbitrary object deserialization.

Vulnerable — Shield flags thisconfig.py

import yaml

def load_config(path: str) -> dict:
    with open(path) as f:
        return yaml.load(f)

Fixed — scans cleanconfig.py

import yaml

def load_config(path: str) -> dict:
    with open(path) as f:
        return yaml.safe_load(f)

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PY-013, the fixed one does not.