Read the docs
TI-2013-04085 Aliases CVE-2013-4660GHSA-xxvw-45rp-3mj2

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the…

Priority MEDIUM 47CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.

Summary

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.

Why it matters now

EPSS 0.17186 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed js-yaml (npm): 2.0.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—js-yaml (npm)before 2.0.52.0.5Patch availableGHSA-xxvw-45rp-3mj2
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • js-yaml (npm) Vendor— Affected before 2.0.5 Fixed in 2.0.5 Patch available GHSA-xxvw-45rp-3mj2

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:*:*:*up to 2.0.4Vulnerablenodeca
cpe:2.3:a:nodeca:js-yaml:0.2.0:*:*:*:*:*:*:*0.2.0Vulnerablenodeca
cpe:2.3:a:nodeca:js-yaml:0.2.1:*:*:*:*:*:*:*0.2.1Vulnerablenodeca
cpe:2.3:a:nodeca:js-yaml:0.2.2:*:*:*:*:*:*:*0.2.2Vulnerablenodeca
cpe:2.3:a:nodeca:js-yaml:0.3.0:*:*:*:*:*:*:*0.3.0Vulnerablenodeca
cpe:2.3:a:nodeca:js-yaml:0.3.1:*:*:*:*:*:*:*0.3.1Vulnerablenodeca
cpe:2.3:a:nodeca:js-yaml:0.3.2:*:*:*:*:*:*:*0.3.2Vulnerablenodeca
cpe:2.3:a:nodeca:js-yaml:0.3.3:*:*:*:*:*:*:*0.3.3Vulnerablenodeca
cpe:2.3:a:nodeca:js-yaml:0.3.4:*:*:*:*:*:*:*0.3.4Vulnerablenodeca
cpe:2.3:a:nodeca:js-yaml:0.3.5:*:*:*:*:*:*:*0.3.5Vulnerablenodeca
  • cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:*:*:* Versions up to 2.0.4 Vulnerable ·nodeca
  • cpe:2.3:a:nodeca:js-yaml:0.2.0:*:*:*:*:*:*:* Versions 0.2.0 Vulnerable ·nodeca
  • cpe:2.3:a:nodeca:js-yaml:0.2.1:*:*:*:*:*:*:* Versions 0.2.1 Vulnerable ·nodeca
  • cpe:2.3:a:nodeca:js-yaml:0.2.2:*:*:*:*:*:*:* Versions 0.2.2 Vulnerable ·nodeca
  • cpe:2.3:a:nodeca:js-yaml:0.3.0:*:*:*:*:*:*:* Versions 0.3.0 Vulnerable ·nodeca
  • cpe:2.3:a:nodeca:js-yaml:0.3.1:*:*:*:*:*:*:* Versions 0.3.1 Vulnerable ·nodeca
  • cpe:2.3:a:nodeca:js-yaml:0.3.2:*:*:*:*:*:*:* Versions 0.3.2 Vulnerable ·nodeca
  • cpe:2.3:a:nodeca:js-yaml:0.3.3:*:*:*:*:*:*:* Versions 0.3.3 Vulnerable ·nodeca
  • cpe:2.3:a:nodeca:js-yaml:0.3.4:*:*:*:*:*:*:* Versions 0.3.4 Vulnerable ·nodeca
  • cpe:2.3:a:nodeca:js-yaml:0.3.5:*:*:*:*:*:*:* Versions 0.3.5 Vulnerable ·nodeca
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:nodeca:js-yaml:0.3.6:*:*:*:*:*:*:*0.3.6Vulnerablenodeca
cpe:2.3:a:nodeca:js-yaml:0.3.7:*:*:*:*:*:*:*0.3.7Vulnerablenodeca
cpe:2.3:a:nodeca:js-yaml:1.0.0:*:*:*:*:*:*:*1.0.0Vulnerablenodeca
cpe:2.3:a:nodeca:js-yaml:1.0.1:*:*:*:*:*:*:*1.0.1Vulnerablenodeca
cpe:2.3:a:nodeca:js-yaml:1.0.2:*:*:*:*:*:*:*1.0.2Vulnerablenodeca
cpe:2.3:a:nodeca:js-yaml:1.0.3:*:*:*:*:*:*:*1.0.3Vulnerablenodeca
cpe:2.3:a:nodeca:js-yaml:2.0.0:*:*:*:*:*:*:*2.0.0Vulnerablenodeca
cpe:2.3:a:nodeca:js-yaml:2.0.1:*:*:*:*:*:*:*2.0.1Vulnerablenodeca
cpe:2.3:a:nodeca:js-yaml:2.0.2:*:*:*:*:*:*:*2.0.2Vulnerablenodeca
cpe:2.3:a:nodeca:js-yaml:2.0.3:*:*:*:*:*:*:*2.0.3Vulnerablenodeca
  • cpe:2.3:a:nodeca:js-yaml:0.3.6:*:*:*:*:*:*:* Versions 0.3.6 Vulnerable ·nodeca
  • cpe:2.3:a:nodeca:js-yaml:0.3.7:*:*:*:*:*:*:* Versions 0.3.7 Vulnerable ·nodeca
  • cpe:2.3:a:nodeca:js-yaml:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·nodeca
  • cpe:2.3:a:nodeca:js-yaml:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·nodeca
  • cpe:2.3:a:nodeca:js-yaml:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·nodeca
  • cpe:2.3:a:nodeca:js-yaml:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·nodeca
  • cpe:2.3:a:nodeca:js-yaml:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·nodeca
  • cpe:2.3:a:nodeca:js-yaml:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·nodeca
  • cpe:2.3:a:nodeca:js-yaml:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·nodeca
  • cpe:2.3:a:nodeca:js-yaml:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·nodeca

Remediation

  • Fix · GHSA-xxvw-45rp-3mj2 js-yaml (npm) Fixed in 2.0.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-4660
  2. 2026-10-03 Alias added: GHSA-xxvw-45rp-3mj2

References

Exploit 1

Advisory 3

Other 2

  • TI-2026-42685 js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing CVSS 3.1HIGH 7.5
  • TI-2026-42684 js-yaml: YAML merge-key chains can force quadratic CPU consumption CVSS 3.1HIGH 7.5
  • TI-2026-42683 js-yaml: YAML merge-key chains can force quadratic CPU consumption CVSS 3.1HIGH 7.5
  • TI-2026-38621 js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases CVSS 3.1MEDIUM 5.3
  • TI-2025-40064 js-yaml has prototype pollution in merge (<<) CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences