Homepage

org.webjars.npm:js-yaml@4.3.0

  • latest version

    4.3.1

  • first published

    11 years ago

  • latest version published

    26 days ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.webjars.npm:js-yaml package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Inefficient Algorithmic Complexity

    org.webjars.npm:js-yaml is a human-friendly data serialization language.

    Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the yaml.load process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large !!omap sequence.

    How to fix Inefficient Algorithmic Complexity?

    Upgrade org.webjars.npm:js-yaml to version 3.15.1, 4.3.1 or higher.

    [3.0.0,3.15.1)[4.0.0,4.3.1)
    • H
    Inefficient Algorithmic Complexity

    org.webjars.npm:js-yaml is a human-friendly data serialization language.

    Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the readFlowCollection function of parser.ts, which reaches exponential time when a flow sequence entry turns out to be a key: value pair and the parser rewinds to parse that entry a second time as the key. An attacker can exhaust CPU and block the Node event loop by supplying a small YAML document, under 200 bytes, with deeply nested flow sequences of key: value entries, since the re-parsing makes the work grow as O(2^n) in nesting depth. Exploitation occurs under the default configuration when the application parses untrusted YAML with load() or loadAll(), and needs no special schema, anchors, aliases, or merge keys.

    How to fix Inefficient Algorithmic Complexity?

    A fix was pushed into the master branch but not yet published.

    [0,)
    • H
    Inefficient Algorithmic Complexity

    org.webjars.npm:js-yaml is a human-friendly data serialization language.

    Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in merge key (<<) handling during YAML parsing, where each mapping in a chain re-enumerates the keys inherited from the previous mapping. An attacker can exhaust CPU and cause denial of service by supplying a document with N chained merge mappings, which forces roughly O(N^2) work for O(N) input. Exploitation requires the application to parse untrusted YAML with the default or YAML11 schema, under which merge keys are resolved.

    How to fix Inefficient Algorithmic Complexity?

    Upgrade org.webjars.npm:js-yaml to version 4.3.1 or higher.

    [,4.3.1)
    Go back to all versions of this package