Executive brief
js-yaml is a popular JavaScript library for parsing YAML configuration files. Versions 2.0.4 and earlier allow arbitrary code execution when processing untrusted YAML input through the .load() method, enabling attackers to execute malicious code directly on systems that parse such data.
Technical details
The vulnerability is a deserialization code execution flaw in the YAML deserializer (CWE-20: Improper Input Validation). The root cause is unsafe handling of JavaScript-specific YAML tags (!!js/function) that allow embedding and executing arbitrary JavaScript functions during deserialization. An attacker can craft malicious YAML input containing function definitions that are executed when parsed via the .load() method. No authentication or special preconditions are required—any application that parses untrusted YAML using the vulnerable .load() method is susceptible. The fix is to upgrade to js-yaml 2.0.5 or later and replace all .load() calls with .safeLoad().
Affected products
- js-yaml js-yaml 2.0.4 and earlier
Timeline
- 2013: disclosed: Original vulnerability disclosed
- 2017-10-24: advisory: GitHub Security Advisory published
- 2013: patched: Fix available in js-yaml 2.0.5