[Security] Unsafe YAML Deserialization leads to Remote Code Execution

Vulnerability Report

GPTCache uses in at .

The function loads YAML configuration with , which allows tags to instantiate arbitrary Python objects. An attacker who can control the YAML file content can achieve Remote Code Execution.

Proof of Concept

Place this in the config YAML file and trigger .

Impact

Remote Code Execution via crafted configuration file. CVSS: 7.8 (High)

Remediation

Use instead of , or use .