ghsa-xxvw-45rp-3mj2
Vulnerability from github
Published
2017-10-24 18:33
Modified
2021-09-22 18:27
Summary
Deserialization Code Execution in js-yaml
Details

Versions 2.0.4 and earlier of js-yaml are affected by a code execution vulnerability in the YAML deserializer.

Proof of Concept

``` const yaml = require('js-yaml');

const x = test: !!js/function > function f() { console.log(1); }();

yaml.load(x); ```

Recommendation

Update js-yaml to version 2.0.5 or later, and ensure that all instances where the .load() method is called are updated to use .safeLoad() instead.

Show details on source website

To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "js-yaml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2013-4660"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T22:05:02Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "Versions 2.0.4 and earlier of `js-yaml` are affected by a code execution vulnerability in the YAML deserializer.\n\n## Proof of Concept\n```\nconst yaml = require(\u0027js-yaml\u0027);\n\nconst x = `test: !!js/function \u003e\nfunction f() { \nconsole.log(1); \n}();`\n\nyaml.load(x);\n```\n\n\n## Recommendation\n\nUpdate js-yaml to version 2.0.5 or later, and ensure that all instances where the `.load()` method is called are updated to use `.safeLoad()` instead.",
  "id": "GHSA-xxvw-45rp-3mj2",
  "modified": "2021-09-22T18:27:56Z",
  "published": "2017-10-24T18:33:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4660"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-xxvw-45rp-3mj2"
    },
    {
      "type": "WEB",
      "url": "https://nealpoole.com/blog/2013/06/code-execution-via-yaml-in-js-yaml-nodejs-module"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/16"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Deserialization Code Execution in js-yaml"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.