EIQ-2019-0020

EIQ-2019-0020

-

js-yaml 3.13.0 and earlier are vulnerable to code injection

24 Apr 2019

3 - HIGH

CVSSv3 score not available on NIST NVD.

All versions

js-yaml versions 3.13.0 and earlier are vulnerable to code injection.
An attacker could pass executable JavaScript code in a malicious YAML file as a value of the toString key.
If toString is used as an explicit mapping key, an attacker could arbitrarily execute the supplied code by passing it with the load() method.

The safeLoad() method is unaffected because it cannot parse functions.

Upgrade js-yaml to version 3.13.1 or later.

At the moment, it is not possible to globally upgrade js-yaml, because it occurs at least once as a sub-dependency.
Sub-dependencies are indirect dependencies of other third-party dependencies.

We cannot control these dependencies.
We address these issues as soon as eligible third-party patches become available through their respective vendors, owners, or official maintainers.

None

For more information, see:

• npm security advisory about the vulnerability

• Snyk report about the vulnerability

• GitHub commit with the fix

• GitHub pull request