nodeca/js-yaml
GitHub
CVE History
| CVE | Affected | Published | CVSS v3 | CVSS v2 |
|---|---|---|---|---|
| >= 5.0.0, < 5.2.0 | 5.3 MEDIUM | — | ||
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0. | ||||
| >= 3.0.0, < 3.15.0, >= 4.0.0, < 4.3.0 | 7.5 HIGH | — | ||
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0. | ||||
| >= 5.0.0, < 5.2.1 | 5.3 MEDIUM | — | ||
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. This issue is fixed in version 5.2.1. | ||||
| < 4.2.0, >= 4.0.0, < 4.2.0, < 3.15.0 | 5.3 MEDIUM | — | ||
js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0. | ||||
| = *, < 3.14.2, >= 4.0.0, < 4.1.1 | 5.3 MEDIUM | — | ||
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default). | ||||
| = *, = 0.2.2, = 2.0.0, = 1.0.1, = 0.3.2, = 0.3.3, = 2.0.2, = 0.2.0, = 0.3.0, = 0.3.1, = 1.0.0, = 1.0.2, = 2.0.3, = 0.2.1, = 1.0.3, = 2.0.1, = 0.3.4, = 0.3.5, = 0.3.6, = 0.3.7, <= 2.0.4, < 2.0.5 | — | 6.8 MEDIUM | ||
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation. | ||||