CVE-2013-4660: Deserialization Code Execution in js-yaml
Summary
CVE-2013-4660: Deserialization Code Execution in js-yaml. Affects js-yaml versions < 2.0.5. Fixed in 2.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The js-yaml package is an open-source JavaScript library that provides a YAML parser and serializer. It allows developers to parse YAML data into JavaScript objects and serialize JavaScript objects into YAML format. The package is widely used in various applications and frameworks for handling YAML data. However, versions 2.0.4 and earlier of js-yaml are vulnerable to a code execution vulnerability in the YAML deserializer.
Vulnerability Detail
The vulnerability in js-yaml arises from a code execution flaw in the YAML deserializer. An attacker can exploit this vulnerability by crafting a malicious YAML payload that includes a specially crafted JavaScript function. When the payload is deserialized using the affected versions of js-yaml, the JavaScript function is executed, leading to arbitrary code execution. This can result in various security risks, including remote code execution, data leakage, and unauthorized access to sensitive information.
How To Fix
Latest published version: 5.5.0 as of 23 Oct 2026
npm install js-yaml@5.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.5
This is the first release that contains the fix.
npm install js-yaml@2.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A workaround for this vulnerability is to sanitize and validate the YAML data before deserialization. This can be done by implementing a custom validation mechanism that checks the structure and content of the YAML data before passing it to the js-yaml library for deserialization. By carefully validating the input, developers can mitigate the risk of executing malicious code embedded in the YAML payload.
Conclusion
The js-yaml package versions 2.0.4 and earlier are vulnerable to a code execution vulnerability in the YAML deserializer. To mitigate this risk, it is crucial to update to version 2.0.5 or later and replace all instances of the .load() method with .safeLoad(). Additionally, implementing custom validation and sanitization of YAML data can provide an extra layer of protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for js-yaml →
FAQ
js-yaml is a JavaScript library that provides a YAML parser and serializer. It allows developers to work with YAML data in JavaScript applications.
Versions 2.0.4 and earlier of js-yaml are affected by this vulnerability.
This vulnerability can lead to arbitrary code execution, enabling attackers to execute malicious code on the affected system, potentially resulting in remote code execution, data leakage, and unauthorized access to sensitive information.
To fix this vulnerability, update the js-yaml package to version 2.0.5 or later and ensure that all instances of the .load() method are replaced with .safeLoad() method.
Yes, a workaround is to implement custom validation and sanitization of the YAML data before deserialization to mitigate the risk of executing malicious code.
Related vulnerabilities
Recent vulnerabilities recorded for js-yaml.
