Deserialization Code Execution in js-yaml (GHSA-xxvw-45rp-3mj2)
Published: 2017-10-24T18:33:37Z
Aliases: CVE-2013-4660
Severity: CRITICAL · CWE: CWE-20

Versions 2.0.4 and earlier of `js-yaml` are affected by a code execution vulnerability in the YAML deserializer.

## Proof of Concept
```
const yaml = require('js-yaml');

const x = `test: !!js/function >
function f() { 
console.log(1); 
}();`

yaml.load(x);
```


## Recommendation

Update js-yaml to version 2.0.5 or later, and ensure that all instances where the `.load()` method is called are updated to use `.safeLoad()` instead.

Affected packages:
package: ecosystem: npm
name: js-yaml
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.0.5