Denial Of Service (DoS)

js-yaml is vulnerable to denial of service. A remote attacker is able to exhaust system resources by submitting a malicious YAML file that would stall the node process and potentially result in a crash...

Denial of Service

Overview Versions of js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service. Recommendation Upgrade to version 3.13.0. References GitHub Advisory...

Deserialization Code Execution in js-yaml

Versions 2.0.4 and earlier of js-yaml are affected by a code execution vulnerability in the YAML deserializer. Proof of Concept const yaml = require'js-yaml'; const x = test: !!js/function function f console.log1; ; yaml.loadx; Recommendation Update js-yaml to version 2.0.5 or later, and ensure...

attester (>=1.1.0, <=1.2.0), awsboxen (>=0.1.0, <=0.5.1) +7 more potentially affected by CVE-2013-4660 via js-yaml (>=2.0.1, <=2.0.4)

js-yaml NPM version =2.0.1, =1.1.0, =0.1.0, =0.13.13, =0.5.0, =0.8.3, =0.0.2, =0.1.8, =0.0.1, =0.2.4 Source cves: CVE-2013-4660 Source advisory: OSV:GHSA-XXVW-45RP-3MJ2...

GHSA-XXVW-45RP-3MJ2 Deserialization Code Execution in js-yaml

Versions 2.0.4 and earlier of js-yaml are affected by a code execution vulnerability in the YAML deserializer. Proof of Concept const yaml = require'js-yaml'; const x = test: !!js/function function f console.log1; ; yaml.loadx; Recommendation Update js-yaml to version 2.0.5 or later, and ensure...

Deserialization Code Execution

Overview Versions 2.0.4 and earlier of js-yaml are affected by a code execution vulnerability in the YAML deserializer. Proof of Concept const yaml = require'js-yaml'; const x = test: !!js/function function f console.log1; ; yaml.loadx; Recommendation Update js-yaml to version 2.0.5 or later, and...

Nodejs js-yaml load() Code Execution (CVE-2013-4660)

A JavaScript Code Execution vulnerability has been reported in Nodejs...

Nodejs - 'js-yaml load()' Code Exec (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Nodejs js-yaml load Code Exec',...

Nodejs js-yaml load() Code Execution Vulnerability

For node.js applications that parse user-supplied YAML input using the load function from the 'js-yaml' package versions below 2.0.5, specifying a self-executing function allows us to execute arbitrary javascript code. This Metasploit module demonstrates that behavior. This file is part of the...

CVE-2013-4660

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation...

Code injection

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation...

CVE-2013-4660

CVE-2013-4660 affects the JS-YAML package for Node.js prior to 2.0.5. The vulnerability arises when parsing YAML input with the unsafe !!js/function tag, which can trigger an eval and allow remote code execution. IBM X-Force/other sources confirm a high-severity impact (code execution via crafted...