Code Injection in js-yaml
Summary
GHSA-8j8c-7jfh-h6hx: Code Injection in js-yaml. Affects js-yaml versions < 3.13.1. Fixed in 3.13.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The js-yaml package is an open-source JavaScript library that provides a YAML parser and serializer. It allows developers to parse YAML files into JavaScript objects and serialize JavaScript objects into YAML format. The package is widely used in various applications and frameworks.
Vulnerability Detail
Versions of js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function in the package may execute arbitrary code injected through a malicious YAML file. Attackers can exploit this vulnerability by using objects with toString as the key and JavaScript code as the value, which are then used as explicit mapping keys. This allows the attackers to execute the injected code through the load() function. It is important to note that the safeLoad() function in the package is unaffected by this vulnerability.
An example payload that demonstrates the vulnerability is:
{ toString: !<tag:yaml.org,2002:js/function> 'function (){return Date.now()}' } : 1
This payload, when processed by the vulnerable load() function, returns the object:
{
"1553107949161": 1
}
This vulnerability poses a high risk as it allows an attacker to execute arbitrary code on the affected system, potentially leading to remote code execution, data breaches, or other malicious activities.
How To Fix
Latest published version: 5.5.0 as of 23 Oct 2026
npm install js-yaml@5.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.13.1
This is the first release that contains the fix.
npm install js-yaml@3.13.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The js-yaml package prior to version 3.13.1 is vulnerable to code injection, which allows attackers to execute arbitrary code through a malicious YAML file. To mitigate this vulnerability, it is crucial to upgrade to version 3.13.1 or later of the package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for js-yaml →
FAQ
This vulnerability allows an attacker to execute arbitrary code on the affected system, potentially leading to remote code execution, data breaches, or other malicious activities.
Versions of js-yaml prior to 3.13.1 are affected by this vulnerability.
No, the safeLoad() function in the js-yaml package is not affected by this vulnerability. It is recommended to use the safeLoad() function to parse YAML files to ensure security.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for vulnerabilities, including this code injection vulnerability in js-yaml.
No, there are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version of the js-yaml package.
References
Related vulnerabilities
Recent vulnerabilities recorded for js-yaml.
