Severity: high

Code Injection



Versions of js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file. Objects that have toString as key, JavaScript code as value and are used as explicit mapping keys allow attackers to execute the supplied code through the load() function. The safeLoad() function is unaffected.

An example payload is { toString: !<,2002:js/function> 'function (){return}' } : 1 which returns the object { "1553107949161": 1 }


Upgrade to version 3.13.1.


Have content suggestions? Send them to [email protected]

Advisory timeline

  1. published

    Advisory Published
    Apr 15th, 2019
  2. reported

    Reported by Alex Kocharin
    Apr 10th, 2019