GHSA-xxvw-45rp-3mj2
Deserialization Code Execution in js-yaml
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
Versions 2.0.4 and earlier of `js-yaml` are affected by a code execution vulnerability in the YAML deserializer.
## Proof of Concept
```
const yaml = require('js-yaml');
const x = `test: !!js/function >
function f() {
console.log(1);
}();`
yaml.load(x);
```
## Recommendation
Update js-yaml to version 2.0.5 or later, and ensure that all instances where the `.load()` method is called are updated to use `.safeLoad()` instead.
References
External links from the advisory. They lead to third-party sites.