Executive brief
js-yaml is a popular YAML parser used in Node.js applications. The library contains a prototype pollution vulnerability in its merge operation (<<) that allows attackers to modify object prototypes when parsing untrusted YAML documents. This could enable attackers to inject malicious properties into application objects, leading to unexpected behavior, authentication bypass, or code execution depending on how the application uses the parsed data.
Technical details
The vulnerability is a prototype pollution flaw in js-yaml versions 4.0.0–4.1.0 and below 3.14.2, occurring in the merge operator (<<) during YAML deserialization. An attacker can craft a malicious YAML document that pollutes the Object prototype by setting __proto__ properties, affecting all objects created after parsing. The attack requires the application to parse untrusted YAML input and does not require authentication or network access beyond submitting the YAML payload. The impact ranges from object property manipulation to potential code execution if the application relies on prototype-based logic. Patches are available in js-yaml 4.1.1 and 3.14.2.
Affected products
- nodeca js-yaml >=4.0.0, <4.1.1 and <3.14.2
Timeline
- 2025-11-12: disclosed
- 2025-11-12: patched: Patched in js-yaml 4.1.1 and 3.14.2