Packages / js-yaml / Security

CriticalVulnerabilityGHSA-xxvw-45rp-3mj2CVE-2013-4660Published 24 Oct 2017

Deserialization Code Execution in js-yaml

Your version

Affected releases · js-yaml

  • 2.x2.0.0 – 2.0.4Fixed in 2.0.5
  • 1.x and older0.2.0 – 1.0.3No fix, no longer updated

On 2.x, the newest line:

npm install js-yaml@2.0.5
Every release on a timeline
5.x

  1. Not affected

    5.0.0 – 5.5.0

    12 releases, latest

2.x

  1. Affected

    2.0.0 – 2.0.4

    5 releases

  2. Fixed

    2.0.5 – 2.1.3

    5 releases

1.x

  1. Affected

    1.0.0 – 1.0.3

    4 releases

0.x

  1. Affected

    0.2.0 – 0.3.7

    11 releases

94 stable releases of js-yaml, oldest to newest, one row per major.

What happens

Versions 2.0.4 and earlier of js-yaml are affected by a code execution vulnerability in the YAML deserializer.

Proof of Concept

const yaml = require('js-yaml');

const x = `test: !!js/function >
function f() { 
console.log(1); 
}();`

yaml.load(x);

Recommendation

Update js-yaml to version 2.0.5 or later, and ensure that all instances where the .load() method is called are updated to use .safeLoad() instead.