HIGH
GHSA-8j8c-7jfh-h6hx
Code Injection in js-yaml
Quick fix
GHSA-8j8c-7jfh-h6hx — js-yaml: upgrade to the fixed version with the command below.
npm install js-yaml@3.13.1Details
Versions of `js-yaml` prior to 3.13.1 are vulnerable to Code Injection. The `load()` function may execute arbitrary code injected through a malicious YAML file. Objects that have `toString` as key, JavaScript code as value and are used as explicit mapping keys allow attackers to execute the supplied code through the `load()` function. The `safeLoad()` function is unaffected.
An example payload is `{ toString: !<tag:yaml.org,2002:js/function> 'function (){return Date.now()}' } : 1` which returns the object { "1553107949161": 1 }
## Recommendation
Upgrade to version 3.13.1.
Are you affected?
Enter the version of the package you're using.