Homepage

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') The advisory has been revoked - it doesn't affect any version of package automation-gateway.src  (opens in a new tab)

Threat Intelligence

EPSS
0.03% (11th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-AUTOMATIONGATEWAYSRC-15053266
  • published22 Jan 2026
  • disclosed13 Nov 2025
Report a new vulnerability Found a mistake?

Introduced: 13 Nov 2025

CVE-2025-64718  (opens in a new tab)
CWE-1321  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream automation-gateway.src package and not the automation-gateway.src package as distributed by RHEL.

js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).