CVE-2025-64718
In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`).
Does this matter?
Lower severity and a low EPSS score (0.42%). Track it; it rarely justifies an emergency change on its own.
Description
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 0.42% probability · 36th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-1321
- Affected
- nodeca/js-yaml
- Source
- security-advisories@github.com
EPSS 0.4% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879Patch
- https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266Patch
- https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876Issue Tracking
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8mVendor Advisory
- https://github.com/advisories/GHSA-mh29-5h37-fv8mVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.