The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.
References
| Link | Resource |
|---|---|
| http://portal.nodesecurity.io/advisories/js-yaml | Vendor Advisory |
| https://nealpoole.com/blog/2013/06/code-execution-via-yaml-in-js-yaml-nodejs-module/ | Exploit Vendor Advisory |
| http://portal.nodesecurity.io/advisories/js-yaml | Vendor Advisory |
| https://nealpoole.com/blog/2013/06/code-execution-via-yaml-in-js-yaml-nodejs-module/ | Exploit Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
02 Dec 2025, 13:29
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Nodeca js-yaml
Nodeca |
|
| CPE | cpe:2.3:a:js-yaml_project:js-yaml:1.0.2:*:*:*:*:*:*:* cpe:2.3:a:js-yaml_project:js-yaml:0.3.3:*:*:*:*:*:*:* cpe:2.3:a:js-yaml_project:js-yaml:0.2.2:*:*:*:*:*:*:* cpe:2.3:a:js-yaml_project:js-yaml:1.0.0:*:*:*:*:*:*:* cpe:2.3:a:js-yaml_project:js-yaml:0.3.6:*:*:*:*:*:*:* cpe:2.3:a:js-yaml_project:js-yaml:*:*:*:*:*:*:*:* cpe:2.3:a:js-yaml_project:js-yaml:1.0.3:*:*:*:*:*:*:* cpe:2.3:a:js-yaml_project:js-yaml:0.2.1:*:*:*:*:*:*:* cpe:2.3:a:js-yaml_project:js-yaml:0.3.2:*:*:*:*:*:*:* cpe:2.3:a:js-yaml_project:js-yaml:0.3.0:*:*:*:*:*:*:* cpe:2.3:a:js-yaml_project:js-yaml:0.3.1:*:*:*:*:*:*:* cpe:2.3:a:js-yaml_project:js-yaml:0.3.4:*:*:*:*:*:*:* cpe:2.3:a:js-yaml_project:js-yaml:0.3.7:*:*:*:*:*:*:* cpe:2.3:a:js-yaml_project:js-yaml:0.3.5:*:*:*:*:*:*:* cpe:2.3:a:js-yaml_project:js-yaml:2.0.1:*:*:*:*:*:*:* cpe:2.3:a:js-yaml_project:js-yaml:1.0.1:*:*:*:*:*:*:* cpe:2.3:a:js-yaml_project:js-yaml:2.0.2:*:*:*:*:*:*:* cpe:2.3:a:js-yaml_project:js-yaml:0.2.0:*:*:*:*:*:*:* cpe:2.3:a:js-yaml_project:js-yaml:2.0.0:*:*:*:*:*:*:* |
cpe:2.3:a:nodeca:js-yaml:1.0.2:*:*:*:*:*:*:* cpe:2.3:a:nodeca:js-yaml:0.3.3:*:*:*:*:*:*:* cpe:2.3:a:nodeca:js-yaml:1.0.3:*:*:*:*:*:*:* cpe:2.3:a:nodeca:js-yaml:0.3.4:*:*:*:*:*:*:* cpe:2.3:a:nodeca:js-yaml:1.0.1:*:*:*:*:*:*:* cpe:2.3:a:nodeca:js-yaml:0.3.2:*:*:*:*:*:*:* cpe:2.3:a:nodeca:js-yaml:1.0.0:*:*:*:*:*:*:* cpe:2.3:a:nodeca:js-yaml:0.2.2:*:*:*:*:*:*:* cpe:2.3:a:nodeca:js-yaml:2.0.2:*:*:*:*:*:*:* cpe:2.3:a:nodeca:js-yaml:0.3.5:*:*:*:*:*:*:* cpe:2.3:a:nodeca:js-yaml:0.3.0:*:*:*:*:*:*:* cpe:2.3:a:nodeca:js-yaml:2.0.3:*:*:*:*:*:*:* cpe:2.3:a:nodeca:js-yaml:0.2.1:*:*:*:*:*:*:* cpe:2.3:a:nodeca:js-yaml:0.2.0:*:*:*:*:*:*:* cpe:2.3:a:nodeca:js-yaml:2.0.1:*:*:*:*:*:*:* cpe:2.3:a:nodeca:js-yaml:2.0.0:*:*:*:*:*:*:* cpe:2.3:a:nodeca:js-yaml:0.3.1:*:*:*:*:*:*:* cpe:2.3:a:nodeca:js-yaml:0.3.6:*:*:*:*:*:*:* cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:*:*:* cpe:2.3:a:nodeca:js-yaml:0.3.7:*:*:*:*:*:*:* |
Information
Published : 2013-06-28 14:55
Updated : 2025-12-02 13:29
NVD link : CVE-2013-4660
Mitre link : CVE-2013-4660
CVE.ORG link : CVE-2013-4660
JSON object : View
Products Affected
nodeca
- js-yaml
CWE
CWE-20
Improper Input Validation