{"record":{"id":"264e951f33cbffd8","repo":"puppetlabs/puppet","slug":"serialized-yaml-did-not-contain-a-valid-instance-o","errorCode":null,"errorMessage":"Serialized YAML did not contain a valid instance of %{klass}: %{message}","messagePattern":"Serialized YAML did not contain a valid instance of %(.+?): %(.+?)","errorType":"exception","errorClass":"Puppet::Network::FormatHandler::FormatError","httpStatus":null,"severity":"error","filePath":"lib/puppet/network/formats.rb","lineNumber":42,"sourceCode":"  end\nend\n\nPuppet::Network::FormatHandler.create_serialized_formats(:yaml) do\n  def allowed_yaml_classes\n    @allowed_yaml_classes ||= [\n      Puppet::Node::Facts,\n      Puppet::Node,\n      Puppet::Transaction::Report,\n      Puppet::Resource,\n      Puppet::Resource::Catalog\n    ]\n  end\n\n  def intern(klass, text)\n    data = Puppet::Util::Yaml.safe_load(text, allowed_yaml_classes)\n    data_to_instance(klass, data)\n  rescue Puppet::Util::Yaml::YamlLoadError => e\n    raise Puppet::Network::FormatHandler::FormatError, _(\"Serialized YAML did not contain a valid instance of %{klass}: %{message}\") % { klass: klass, message: e.message }\n  end\n\n  def intern_multiple(klass, text)\n    data = Puppet::Util::Yaml.safe_load(text, allowed_yaml_classes)\n    unless data.respond_to?(:collect)\n      raise Puppet::Network::FormatHandler::FormatError, _(\"Serialized YAML did not contain a collection of instances when calling intern_multiple\")\n    end\n\n    data.collect do |datum|\n      data_to_instance(klass, datum)\n    end\n  rescue Puppet::Util::Yaml::YamlLoadError => e\n    raise Puppet::Network::FormatHandler::FormatError, _(\"Serialized YAML did not contain a valid instance of %{klass}: %{message}\") % { klass: klass, message: e.message }\n  end\n\n  def data_to_instance(klass, data)\n    return data if data.is_a?(klass)\n","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/network/formats.rb#L24-L60","documentation":"The yaml format's intern deserializes with Puppet::Util::Yaml.safe_load restricted to an allow-list of Puppet model classes (facts, node, report, resource, catalog). When safe_load raises YamlLoadError — malformed YAML, disallowed tags or classes outside the allow-list — it is re-raised as FormatError naming the target class and the underlying Psych message. This is Puppet's safe-deserialization boundary for YAML.","triggerScenarios":"Puppet::Node::Facts.convert_from(:yaml, corrupt_or_untrusted) or catalog/report interning where the document contains a disallowed ruby class (e.g. !ruby/object:MyThing), unknown aliases, or plain syntax errors — typically data produced by a different version or hand-edited.","commonSituations":"Hand-edited or truncated cache files under the agent state directory; YAML produced by a newer/older Psych with different tag handling; attempts to smuggle arbitrary objects through facts/reports; cached YAML migrated across Puppet major versions.","solutions":["Read %{message} — it carries the Psych cause and location; fix or regenerate the document accordingly.","If the document legitimately holds a Puppet model class, it must be one of the allow-listed ones (Puppet::Node::Facts, Puppet::Node, Puppet::Transaction::Report, Puppet::Resource, Puppet::Resource::Catalog); re-serialize accordingly.","Delete corrupted cache files (state/yaml/*) and let Puppet rebuild them.","Regenerate the YAML with the same Puppet version that will read it."],"exampleFix":"# before — YAML smuggles an arbitrary object\n--- !ruby/object:Backdoor\n\n# after — plain data the safe loader accepts\n---\nname: web1.example.com\nvalues:\n  uptime_days: 42","handlingStrategy":"validation","validationCode":"begin\n  data = Puppet::Util::Yaml.safe_load(text, [])\nrescue Puppet::Util::Yaml::YamlLoadError => e\n  raise ArgumentError, \"untrusted or invalid YAML: #{e.message}\"\nend\n# only then hand the text to the format\nobj = Klass.convert_from(:yaml, text)","typeGuard":null,"tryCatchPattern":"begin\n  obj = Klass.convert_from(:yaml, text)\nrescue Puppet::Network::FormatHandler::FormatError => e\n  # e.message: 'Serialized YAML did not contain a valid instance of ...' plus the cause\n  raise\nend","preventionTips":["Never hand-edit Puppet's cached YAML; delete and regenerate.","Produce YAML with the same Puppet/Psych version that consumes it.","Keep documents to plain scalars/maps plus allow-listed Puppet classes.","Treat YamlLoadError-class failures on untrusted input as security events."],"tags":["puppet","ruby","yaml","serialization","security","deserialization"],"backgroundTag":"yaml-deserialization-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}