npm

Severity: critical

Deserialization Code Execution

js-yaml

Overview

Versions 2.0.4 and earlier of js-yaml are affected by a code execution vulnerability in the YAML deserializer.

Proof of Concept

const yaml = require('js-yaml');

const x = `test: !!js/function >
function f() { 
console.log(1); 
}();`

yaml.load(x);

Remediation

Update js-yaml to version 2.0.5 or later, and ensure that all instances where the .load() method is called are updated to use .safeLoad() instead.

Have content suggestions? Send them to [email protected]

Advisory timeline

  1. reported

    Initial report by Neal Poole
    Oct 17th, 2015
  2. published

    Advisory published
    Jun 23rd, 2013