pok3 // security notes

Parsing YAML is a minefield

Sun, 27 Sep 2026 15:13:38 -0400

Not long ago I was researching the behavior of YAML parsing libraries as part of my master’s thesis. Since there is a YAML specification , I wanted to assess whether the parsing libraries listed on the official yaml.org website comply with the current specification. My idea is hugely inspired by Nicolas Seriot’s Parsing JSON is a minefield ^[ https://seriot.ch/security/parsing_json.html ], which I definitely recommend reading.

publications

Mon, 01 Jan 0001 00:00:00 +0000

whoami

Mon, 01 Jan 0001 00:00:00 +0000

Hi, I’m pok3. I’m a penetration tester and CTF player who spends most of his time analyzing applications or devices for vulnerabilities, to make the world and the software we rely upon everyday a tiny bit safer.

#What I do

I mostly work on web applications and embedded devices: finding the bug, understanding why it exists, and helping vendors fix it. These days I also play around with AI a lot: Understand its capabilities, figure out how we can efficiently use it for offensive security and how we can secure it.