Deserialization Code Execution

Overview Versions 2.0.4 and earlier of js-yaml are affected by a code execution vulnerability in the YAML deserializer. Proof of Concept const yaml = require'js-yaml'; const x = test: !!js/function function f console.log1; ; yaml.loadx; Recommendation Update js-yaml to version 2.0.5 or later, and...

Nodejs js-yaml load() Code Execution (CVE-2013-4660)

A JavaScript Code Execution vulnerability has been reported in Nodejs...

Nodejs - 'js-yaml load()' Code Exec (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Nodejs js-yaml load Code Exec',...

Nodejs js-yaml load() Code Execution Vulnerability

For node.js applications that parse user-supplied YAML input using the load function from the 'js-yaml' package versions below 2.0.5, specifying a self-executing function allows us to execute arbitrary javascript code. This Metasploit module demonstrates that behavior. This file is part of the...

CVE-2013-4660

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation...

Code injection

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation...

CVE-2013-4660

CVE-2013-4660 affects the JS-YAML package for Node.js prior to 2.0.5. The vulnerability arises when parsing YAML input with the unsafe !!js/function tag, which can trigger an eval and allow remote code execution. IBM X-Force/other sources confirm a high-severity impact (code execution via crafted...