Most recent entries from all

EUVD-2026-181457

fkie_cve-2013-4660

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.

GHSA-xxvw-45rp-3mj2 — Deserialization Code Execution in js-yaml

Affected: npm: js-yaml

Versions 2.0.4 and earlier of `js-yaml` are affected by a code execution vulnerability in the YAML deserializer.

## Proof of Concept ``` const yaml = require('js-yaml');

const x = `test: !!js/function > function f() { console.log(1); }();`

yaml.load(x); ```

## Recommendation

Update js-yaml to version 2.0.5 or later, and ensure that all instances where the `.load()` method is called are updated to use `.safeLoad()` instead.

Most recent entries from all

EUVD-2026-181457

fkie_cve-2013-4660

GHSA-xxvw-45rp-3mj2 — Deserialization Code Execution in js-yaml

gsd-2013-4660