CRITICALCWE-502
PARSE-006 YAML Type Coercion Exploit
Parser Differential: Exploits differences in how parsers (JSON, YAML, markdown) interpret the same input to bypass security controls
Description
Exploits YAML auto-type coercion where strings like "true", "null", "1e10" are interpreted as booleans, null, or numbers differently across parsers
Remediation
Use safe YAML loaders that disable custom tags and type coercion. Explicitly type all configuration values. Block !!python and other language-specific YAML tags.