CVEvulnerability

CVE-2013-4660

6.8 MEDIUM Published 2013-06-28 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2013-06-28
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-20

Description

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.

Affected configurations

• nodeca js-yaml (<= 2.0.4) • nodeca js-yaml 0.2.0 • nodeca js-yaml 0.2.1 • nodeca js-yaml 0.2.2 • nodeca js-yaml 0.3.0 • nodeca js-yaml 0.3.1 • nodeca js-yaml 0.3.2 • nodeca js-yaml 0.3.3 • nodeca js-yaml 0.3.4 • nodeca js-yaml 0.3.5 • nodeca js-yaml 0.3.6 • nodeca js-yaml 0.3.7 • nodeca js-yaml 1.0.0 • nodeca js-yaml 1.0.1 • nodeca js-yaml 1.0.2 • nodeca js-yaml 1.0.3 • nodeca js-yaml 2.0.0 • nodeca js-yaml 2.0.1 • nodeca js-yaml 2.0.2 • nodeca js-yaml 2.0.3

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References