Skip to content

Deserialization Code Execution in js-yaml

Critical severity GitHub Reviewed Published Oct 24, 2017 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

npm js-yaml (npm)

Affected versions

< 2.0.5

Patched versions

2.0.5

Description

Versions 2.0.4 and earlier of js-yaml are affected by a code execution vulnerability in the YAML deserializer.

Proof of Concept

const yaml = require('js-yaml');

const x = `test: !!js/function >
function f() { 
console.log(1); 
}();`

yaml.load(x);

Recommendation

Update js-yaml to version 2.0.5 or later, and ensure that all instances where the .load() method is called are updated to use .safeLoad() instead.

References

Published to the GitHub Advisory Database Oct 24, 2017
Reviewed Jun 16, 2020
Last updated Jan 9, 2023

Severity

Critical

EPSS score

96.876%
(100th percentile)

Weaknesses

CVE ID

CVE-2013-4660

GHSA ID

GHSA-xxvw-45rp-3mj2

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.