4531 matches found
CVE-2025-64718 js-yaml has prototype pollution in merge (<<)
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is patched in...
CVE-2025-64718 js-yaml has prototype pollution in merge (<<)
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is patched in...
CVE-2025-64718 js-yaml has prototype pollution in merge (<<)
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is patched in...
CVE-2025-64718
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is patched in...
EUVD-2025-177024
Malicious code in procyon-yaml-figures-toml npm...
EUVD-2025-176163
Malicious code in subduction-pulsar-yaml-janus npm...
EUVD-2025-176757
Malicious code in refactor-cron-yaml-dog-debug npm...
EUVD-2025-176636
Malicious code in rigel-photon-interferometry-yaml npm...
EUVD-2025-180349
Malicious code in archaeometry-yaml-phoebe-ophiuchus npm...
EUVD-2025-179070
Malicious code in eridanus-react-bootstrap-telesto-yaml npm...
EUVD-2025-178290
Malicious code in java-short-string-java-yaml npm...
EUVD-2025-179791
Malicious code in chakra-ui-sadr-yaml-less-loader npm...
EUVD-2025-176214
Malicious code in static-refactor-grep-yaml-emulate npm...
EUVD-2025-175451
Malicious code in yaml-halley-astrobiology-mutation npm...
EUVD-2025-179637
Malicious code in commitlint-betelgeuse-yaml-indus npm...
EUVD-2025-177498
Malicious code in object-chi-yaml-authorize-zero npm...
EUVD-2025-175984
Malicious code in test-theta-old-yaml-eta npm...
Malicious code in chakra-ui-sadr-yaml-less-loader (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a073ff2d6f60d319212474b26295e2faeab06927317a907039f5600ac134ae0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...