CVE-2013-4940: YUI Cross-site Scripting (XSS) Vulnerability in Moodle and YUI
Summary
CVE-2013-4940: YUI Cross-site Scripting (XSS) vulnerability. Affects yui across 2 version ranges.
>= 3.0.0, < 3.10.11
>= 3.10.12, < 3.10.13
Fixed in 3.10.11 or 3.10.13, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yahoo! YUI (Yahoo User Interface Library) is a collection of utilities and controls designed to make it easier to build interactive web applications. It provides a rich set of features including DOM manipulation, event handling, and animations. This library is widely used in various applications, including Moodle, an open-source learning platform. The vulnerability in question affects specific versions of YUI and Moodle, allowing attackers to exploit the library's handling of URLs to inject malicious scripts.
Vulnerability Detail
The vulnerability is a Cross-site Scripting (XSS) flaw found in the IO Utility component of YUI version 3.10.2. It allows remote attackers to inject arbitrary web scripts or HTML through crafted strings in URLs. This issue arose due to a regression from a previous CVE-2013-4939 fix, which failed to address the underlying problem effectively. If exploited, this vulnerability could lead to unauthorized access, data theft, or manipulation of user sessions.
How To Fix
Latest published version: 3.18.1 as of 22 Oct 2026
npm install yui@3.18.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.10.113.10.11npm install yui@3.10.11 -
>= 3.10.12, < 3.10.133.10.13npm install yui@3.10.13
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not feasible, consider sanitizing user inputs and validating URLs to prevent the execution of malicious scripts. Implement Content Security Policy (CSP) headers to mitigate the risk of XSS attacks.
Conclusion
The YUI Cross-site Scripting vulnerability (CVE-2013-4940) poses a significant risk to applications using affected versions of YUI and Moodle. It is crucial to update to the patched versions to safeguard against potential attacks. Additionally, implementing workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for yui →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to data theft or session hijacking.
You can use Vulert to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the Vulert playground at Vulert Scanner.
Failure to address this vulnerability could result in unauthorized access to user data, compromised user sessions, and potential damage to your application's reputation.
Yes, you can implement input validation and sanitization, along with CSP headers, to reduce the risk of XSS attacks until a patch is applied.
Detailed information about this vulnerability can be found in the advisory database at GitHub or through the CVE database.
Related vulnerabilities
Recent vulnerabilities recorded for yui.
