GitHub Advisoryadvisory · npm
GHSA-xxvw-45rp-3mj2 Deserialization Code Execution in js-yaml
CRITICAL
Official page ↗
- Aliases
- CVE-2013-4660
- Ecosystem
- npm
- Packages
- js-yaml
- Severity
- Critical
- Weaknesses
- CWE-20
- Reviewed
- 2020-06-16
Affected packages
• npm js-yaml: < 2.0.5 → fixed in 2.0.5
Description
Versions 2.0.4 and earlier of `js-yaml` are affected by a code execution vulnerability in the YAML deserializer.
Proof of Concept
```
const yaml = require('js-yaml');
const x = `test: !!js/function >
function f() {
console.log(1);
}();`
yaml.load(x);
```
Recommendation
Update js-yaml to version 2.0.5 or later, and ensure that all instances where the `.load()` method is called are updated to use `.safeLoad()` instead.
Related
Alias · CVE (1)
- CVE-2013-4660 The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote… vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness