GHSA-8j8c-7jfh-h6hx

Suggest an improvement
Source
https://github.com/advisories/GHSA-8j8c-7jfh-h6hx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-8j8c-7jfh-h6hx/GHSA-8j8c-7jfh-h6hx.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8j8c-7jfh-h6hx
Downstream
CLSA (2)
ROOT (1)
Published
2019-06-04T20:14:07Z
Modified
2020-08-31T18:36:43Z
Summary
Code Injection in js-yaml
Details

Versions of js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file. Objects that have toString as key, JavaScript code as value and are used as explicit mapping keys allow attackers to execute the supplied code through the load() function. The safeLoad() function is unaffected.

An example payload is { toString: !<tag:yaml.org,2002:js/function> 'function (){return Date.now()}' } : 1 which returns the object { "1553107949161": 1 }

Recommendation

Upgrade to version 3.13.1.

Database specific 
{
    "cwe_ids":  [
        "CWE-94"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2019-06-04T20:13:53Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

npm / js-yaml

Package

Name
js-yaml
View open source insights on deps.dev
Purl
pkg:npm/js-yaml

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.13.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-8j8c-7jfh-h6hx/GHSA-8j8c-7jfh-h6hx.json"