Default yaml loader is unsafe

[JulesDT]

Hello !

I think there is an issue in the yaml_loader method in /utils/__init__.py. The default loader used to load templates is unsafe and might lead to an RCE.

mkdocs/mkdocs/utils/__init__.py

Line 62 in cc03fd0

def yaml_load(source, loader=yaml.Loader):

This should rather be the SafeLoader by default to avoid someone loading a malicious template to execute arbitrary code.

[JulesDT]

I made a PR to fix this issue (#1697), as well as a small PoC of this vulnerability available here: https://github.com/JulesDT/mkdocs-theme-rce-poc

[waylan]

This is a duplicate of #1529