7063 matches found
02-infrastructure (1.0.0), 02vue_toast_demo (>=1.0.0, <=1.0.4) +24634 more potentially affected by CVE-2025-64718 via js-yaml (>=0.3.5, <=3.14.1)
js-yaml NPM version =0.3.5, =1.0.0, =1.0.4, =5.0.0, =1.0.3, =2.0.0, =0.0.1, =0.0.2 - 23g-base-css 1.0.0 and more Source cves: CVE-2025-64718 Source advisory: MEND:CVE-2025-64718...
CVE-2025-64718 js-yaml has prototype pollution in merge (<<)
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is patched in...
CVE-2025-64718
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution "proto". All users who parse untrusted yaml documents may be impacted. The problem is patched i...
CVE-2025-64718
CVE-2025-64718 affects js-yaml, allowing prototype pollution via proto when parsing untrusted YAML. The issue is patched in js-yaml 4.1.1 and in 3.14.2. Public IBM bulletins confirm usage of vulnerable js-yaml versions in IBM Maximo components and recommend upgrading to a fixed release (e.g., js-...
CVE-2025-64718
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is patched in...
EUVD-2025-180060
Malicious code in bioinformatics-proxima-uglify-js-rimraf npm...
EUVD-2025-177200
Malicious code in phoenix-apollo-nextjs-nova npm...
EUVD-2025-180051
Malicious code in biosignature-nestjs-publish-morgan npm...
EUVD-2025-179539
Malicious code in cosmicweb-miranda-xerxes-uglify-js npm...
Malicious code in unuk-uglify-js-astrochemistry-comet (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f57906ac6a4735bb92280c00660dfe0fcb082121021fc0d695fd942e50c6163c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in uglify-js-gatsby-mocha-titan (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35678a78049826e95243c5ef05b567ec7a727ae22384d50851840ccd22a90cf5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-175656
Malicious code in warp-dotenv-safe-andromeda-uglify-js npm...
EUVD-2025-176357
Malicious code in sirius-nuxtjs-genomics-hydrogeology npm...
EUVD-2025-178083
Malicious code in link-uglify-js-fermiparadox-auth npm...
MAL-2025-187639 Malicious code in juno-uglify-js-tethys-thermochronology (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca3b11671ecb29ff8f1e78656346b4fcd45de13ee2feb8648e6425fdce8d720c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-175803
Malicious code in unuk-uglify-js-astrochemistry-comet npm...
EUVD-2025-178243
Malicious code in juno-uglify-js-tethys-thermochronology npm...
EUVD-2025-178061
Malicious code in lithosphere-changelog-grunt-uglify-js npm...