Packages / js-yaml / Security

HighVulnerabilityGHSA-8j8c-7jfh-h6hxPublished 4 Jun 2019

Code Injection in js-yaml

Your version

Affected releases · js-yaml

  • 3.x3.0.0 – 3.13.0Fixed in 3.13.1
  • 2.x and older0.2.0 – 2.1.3No fix, no longer updated

On 3.x, the newest line:

npm install js-yaml@3.13.1
Every release on a timeline
5.x

  1. Not affected

    5.0.0 – 5.5.0

    12 releases, latest

3.x

  1. Affected

    3.0.0 – 3.13.0

    43 releases

  2. Fixed

    3.13.1 – 3.15.2

    7 releases

2.x

  1. Affected

    2.0.0 – 2.1.3

    10 releases

1.x

  1. Affected

    1.0.0 – 1.0.3

    4 releases

0.x

  1. Affected

    0.2.0 – 0.3.7

    11 releases

94 stable releases of js-yaml, oldest to newest, one row per major.

What happens

Versions of js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file. Objects that have toString as key, JavaScript code as value and are used as explicit mapping keys allow attackers to execute the supplied code through the load() function. The safeLoad() function is unaffected.

An example payload is { toString: !<tag:yaml.org,2002:js/function> 'function (){return Date.now()}' } : 1 which returns the object { "1553107949161": 1 }

Recommendation

Upgrade to version 3.13.1.