Arbitrary Code Execution Affecting js-yaml package, versions <3.13.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-JSYAML-174129
- published 7 Apr 2019
- disclosed 5 Apr 2019
- credit Alex Kocharin
How to fix?
Upgrade js-yaml to version 3.13.1 or higher.
Overview
js-yaml is a human-friendly data serialization language.
Affected versions of this package are vulnerable to Arbitrary Code Execution. When an object with an executable toString() property used as a map key, it will execute that function. This happens only for load(), which should not be used with untrusted data anyway. safeLoad() is not affected because it can't parse functions.
References
CVSS Scores
version 3.1