diff --git a/requirements.txt b/requirements.txt
index e2411f6..120348b 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -7,7 +7,7 @@ importlib_resources==1.0.2
 inflection==0.3.1
 Jinja2==2.10
 pytest==3.2.2
-PyYAML==3.12
+PyYAML==3.13
 semver==2.7.9
 Sphinx==1.8.4
 sphinx-autobuild==0.7.1
\ No newline at end of file
diff --git a/setup.py b/setup.py
index 92f9a4e..e1ca385 100644
--- a/setup.py
+++ b/setup.py
@@ -34,7 +34,8 @@ def get_readme():
         # We use the `kw_only` only for attribute classes, which was
         # introduced in v18.2.0
         'attrs>=18.2.0',
-        'PyYAML',
+        # TODO #165 PyYAML v3 has vulnerability that does not affect us, but we should upgrade as soon as a fix is available
+        'PyYAML==3.13',
     ],
 
     # Contact Details