The vulnerability of the YAML syntax analysis and parsing library js-yaml lies in the uncontrolled modification of object prototype attributes, allowing attackers to compromise the integrity of the protected information.

🗓️ 31 Jul 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

js-yaml parsing has an uncontrolled prototype modification vulnerability that harms protected data.

Reporter	Title	Published	Views	Family All 129
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	30 Jan 202609:11	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Event Streams	12 Mar 202612:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules (CVE-2025-64718, CVE-2025-64756, CVE-2025-13466 & CVE-2025-65945)	22 Dec 202511:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses werkzeug-3.1.3,fonttools-4.60.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl,lodash.clonedeep-4.5.0.tgz,js-yaml-4.1.0.tgz,mdast-util-towhich is vulnerable to multiple CVEs	30 Jan 202605:39	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of js-yaml-4.1.0.tgz, IBM Sterling Connect:Direct Web Services is affected by modify the prototype of the result of a parsed yaml.	4 Jun 202602:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in DataStage on Cloud Pak for Data	25 Feb 202616:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for March 2026.	27 Mar 202609:11	–	ibm
IBM Security Bulletins	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for April 2026.	5 May 202621:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Manage Component uses js-yaml-4.1.0 in map-application which is vulnerable to CVE-2025-64718	29 Jan 202614:37	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in js-yaml affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	22 Jun 202613:41	–	ibm

Source	Link
github	www.github.com/nodeca/js-yaml/issues/730
github	www.github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266
github	www.github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879
github	www.github.com/advisories/GHSA-mh29-5h37-fv8m
web	www.web.nvd.nist.gov/view/vuln/detail

31 Jul 2026 00:00Current

5.5Medium risk

Vulners AI Score5.5

CVSS 25

CVSS 35.3

EPSS0.00414

yaml parsing library prototype modification protected information security vulnerability