GitHub Advisoryadvisory · npm

GHSA-mh29-5h37-fv8m js-yaml has prototype pollution in merge (<<)

MEDIUM Published 2025-11-14 Modified 2026-01-31 Official page ↗
Aliases
CVE-2025-64718
Ecosystem
npm
Packages
js-yaml
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-1321
Reviewed
2025-11-14

Affected packages

• npm js-yaml: >= 4.0.0, < 4.1.1 → fixed in 4.1.1 • npm js-yaml: < 3.14.2 → fixed in 3.14.2

Description

Impact In js-yaml 4.1.0, 4.0.0, and 3.14.1 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. Patches Problem is patched in js-yaml 4.1.1 and 3.14.2. Workarounds You can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default). References https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html

Related

Alias · CVE (1)

  • CVE-2025-64718 js-yaml is a JavaScript YAML parser and dumper. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References