PT-2013-5118
CVE-2013-4660
·
Published
2013-06-28
·
Updated
2025-12-02
Description by
CVSS 2.0
6.8
MediumMetricsAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
js-yaml versions 2.0.4 and earlier
Description
The issue allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation, due to the JS-YAML module parsing input without properly considering the unsafe !!js/function tag.
Recommendations
Update to version 2.0.5 or later, and ensure that all instances where the
load() method is called are updated to use safeLoad() instead.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾