CVE-2025-64718
js-yaml has prototype pollution in merge (<<)
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
js-yaml has prototype pollution in merge (<<)
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).
- Record
CVE-2025-64718- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
EUVDEUVD-2025-175314
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).
- Record
EUVD-2025-175314- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2pr6-76vf-7546
Denial of Service in js-yaml
Versions of js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.
Recommendation
Upgrade to version 3.13.0.
- Record
GHSA-2pr6-76vf-7546- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mh29-5h37-fv8m
js-yaml has prototype pollution in merge (<<)
Impact
In js-yaml 4.1.0, 4.0.0, and 3.14.1 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted.
Patches
Problem is patched in js-yaml 4.1.1 and 3.14.2.
Workarounds
You can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).
References
https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html
- Record
GHSA-mh29-5h37-fv8m- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8j8c-7jfh-h6hx No score
Code Injection in js-yaml
Versions of js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file. Objects that have toString as key, JavaScript code as value and are used as explicit mapping keys allow attackers to execute the supplied code through the load() function. The safeLoad() function is unaffected.
An example payload is
{ toString: !<tag:yaml.org,2002:js/function> 'function (){return Date.now()}' } : 1
which returns the object
{
"1553107949161": 1
}
Recommendation
Upgrade to version 3.13.1.
- Record
GHSA-8j8c-7jfh-h6hx- Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).
- Record
CVE-2025-64718- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
Show 27 moreShow less
OSV
js-yaml has prototype pollution in merge (<<)
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).
- Record
CVE-2025-64718- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-64718
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).
- Record
DEBIAN-CVE-2025-64718- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-2pr6-76vf-7546
Denial of Service in js-yaml
Versions of js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.
Recommendation
Upgrade to version 3.13.0.
- Record
GHSA-2pr6-76vf-7546- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-mh29-5h37-fv8m
js-yaml has prototype pollution in merge (<<)
Impact
In js-yaml 4.1.0, 4.0.0, and 3.14.1 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted.
Patches
Problem is patched in js-yaml 4.1.1 and 3.14.2.
Workarounds
You can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).
References
https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html
- Record
GHSA-mh29-5h37-fv8m- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVOESA-2026-1166
nodejs-js-yaml security update
This is an implementation of YAML (YAML Ain't Markup Language), a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec.
Security Fix(es):
js-yaml is a JavaScript YAML parser and dumper. In js-yaml 4.1.0 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (proto). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).(CVE-2025-64718)
- Record
OESA-2026-1166- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1167
nodejs-js-yaml security update
This is an implementation of YAML (YAML Ain't Markup Language), a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec.
Security Fix(es):
js-yaml is a JavaScript YAML parser and dumper. In js-yaml 4.1.0 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (proto). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).(CVE-2025-64718)
- Record
OESA-2026-1167- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1168
nodejs-js-yaml security update
This is an implementation of YAML (YAML Ain't Markup Language), a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec.
Security Fix(es):
js-yaml is a JavaScript YAML parser and dumper. In js-yaml 4.1.0 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (proto). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).(CVE-2025-64718)
- Record
OESA-2026-1168- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1169
nodejs-js-yaml security update
This is an implementation of YAML (YAML Ain't Markup Language), a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec.
Security Fix(es):
js-yaml is a JavaScript YAML parser and dumper. In js-yaml 4.1.0 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (proto). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).(CVE-2025-64718)
- Record
OESA-2026-1169- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1170
nodejs-js-yaml security update
This is an implementation of YAML (YAML Ain't Markup Language), a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec.
Security Fix(es):
js-yaml is a JavaScript YAML parser and dumper. In js-yaml 4.1.0 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (proto). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).(CVE-2025-64718)
- Record
OESA-2026-1170- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1171
nodejs-js-yaml security update
This is an implementation of YAML (YAML Ain't Markup Language), a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec.
Security Fix(es):
js-yaml is a JavaScript YAML parser and dumper. In js-yaml 4.1.0 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (proto). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).(CVE-2025-64718)
- Record
OESA-2026-1171- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2025-64718
CVE-2025-64718 in js-yaml - Patched by Root
Root has patched CVE-2025-64718 in the js-yaml package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2025-64718- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-64718
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).
- Record
UBUNTU-CVE-2025-64718- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1773965915 No score
TuxCare security update for js-yaml (3 CVEs)
TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.3.1-tuxcare.1.
- Record
CLSA-2026-1773965915- Updated
- 2026-11-02
OSVCLSA-2026-1774570935 No score
TuxCare security update for js-yaml (5 CVEs)
TuxCare rebuilt js-yaml to address 5 CVEs. Fixed in 3.7.0-tuxcare.1.
- Record
CLSA-2026-1774570935- Updated
- 2026-11-02
OSVCLSA-2026-1778805968 No score
TuxCare security update for js-yaml (2 CVEs)
TuxCare rebuilt js-yaml to address 2 CVEs. Fixed in 4.1.0-tuxcare.1.
- Record
CLSA-2026-1778805968- Updated
- 2026-11-02
OSVCLSA-2026-1781484837 No score
TuxCare security update for js-yaml (3 CVEs)
TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.14.1-tuxcare.1.
- Record
CLSA-2026-1781484837- Updated
- 2026-11-02
OSVCLSA-2026-1790963665 No score
TuxCare security update for js-yaml (5 CVEs)
TuxCare rebuilt js-yaml to address 5 CVEs. Fixed in 3.13.1-tuxcare.1.
- Record
CLSA-2026-1790963665- Updated
- 2026-11-02
OSVGHSA-8j8c-7jfh-h6hx No score
Code Injection in js-yaml
Versions of js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file. Objects that have toString as key, JavaScript code as value and are used as explicit mapping keys allow attackers to execute the supplied code through the load() function. The safeLoad() function is unaffected.
An example payload is
{ toString: !<tag:yaml.org,2002:js/function> 'function (){return Date.now()}' } : 1
which returns the object
{
"1553107949161": 1
}
Recommendation
Upgrade to version 3.13.1.
- Record
GHSA-8j8c-7jfh-h6hx- Weakness
- CWE-94
- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10036-1 No score
cockpit-repos-4.6-1.1 on GA media
These are all security issues fixed in the cockpit-repos-4.6-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10036-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11126-1 No score
velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media
These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11126-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20117-1 No score
Security update for cockpit-subscriptions
This update for cockpit-subscriptions fixes the following issues:
Update to version 12.1:
- CVE-2025-64718: js-yaml: fixed prototype pollution in merge (bsc#1255425).
- Record
openSUSE-SU-2026:20117-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20251-1 No score
Security update for cockpit-repos
This update for cockpit-repos fixes the following issues:
Update to version 4.7.
Security issues fixed:
- CVE-2025-13465: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from global (bsc#1257325).
- CVE-2025-64718: js-yaml prototype pollution in merge (bsc#1255425).
Other updates and bugfixes:
-
version update to 4.7
- Translation updates
-
version update to 4.6:
- Translation updates
- Dependency updates
- Fix translations pot file not being update
-
version update to 4.5:
- Dependency updates
-
version update to 4.4:
- Translation updates
- Dependency updates
- Record
openSUSE-SU-2026:20251-1- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-8j8c-7jfh-h6hx No score
GHSA-8j8c-7jfh-h6hx in js-yaml - Patched by Root
Root has patched GHSA-8j8c-7jfh-h6hx in the js-yaml package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-8j8c-7jfh-h6hx- Updated
- 2026-11-02
OSVSUSE-SU-2026:20170-1 No score
Security update for cockpit-subscriptions
This update for cockpit-subscriptions fixes the following issues:
Update to version 12.1:
- CVE-2025-64718: js-yaml: fixed prototype pollution in merge (bsc#1255425).
- Record
SUSE-SU-2026:20170-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20182-1 No score
Security update for cockpit-subscriptions
This update for cockpit-subscriptions fixes the following issues:
Update to version 12.1:
- CVE-2025-64718: js-yaml: fixed prototype pollution in merge (bsc#1255425).
- Record
SUSE-SU-2026:20182-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20540-1 No score
Security update for cockpit-repos
This update for cockpit-repos fixes the following issues:
Update to version 4.7.
Security issues fixed:
- CVE-2025-13465: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from global (bsc#1257325).
- CVE-2025-64718: js-yaml prototype pollution in merge (bsc#1255425).
Other updates and bugfixes:
-
version update to 4.7
- Translation updates
-
version update to 4.6:
- Translation updates
- Dependency updates
- Fix translations pot file not being update
-
version update to 4.5:
- Dependency updates
-
version update to 4.4:
- Translation updates
- Dependency updates
- Record
SUSE-SU-2026:20540-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20580-1 No score
Security update for cockpit-repos
This update for cockpit-repos fixes the following issues:
Update to version 4.7.
Security issues fixed:
- CVE-2025-13465: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from global (bsc#1257325).
- CVE-2025-64718: js-yaml prototype pollution in merge (bsc#1255425).
Other updates and bugfixes:
-
version update to 4.7
- Translation updates
-
version update to 4.6:
- Translation updates
- Dependency updates
- Fix translations pot file not being update
-
version update to 4.5:
- Dependency updates
-
version update to 4.4:
- Translation updates
- Dependency updates
- Record
SUSE-SU-2026:20580-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
js-yamlnpm |
before 3.13.0 | 3.13.0 |
js-yamlnpm |
before 3.13.1 | 3.13.1 |
js-yamlnpm |
4.0.0 up to 4.1.1 | 4.1.1 |
js-yamlnpm |
before 3.14.2 | 3.14.2 |
js-yamlTuxCare:npm |
3.3.1-tuxcare.0 up to 3.3.1-tuxcare.1, plus listed versions 3.3.1 |
3.3.1-tuxcare.1 |
js-yamlTuxCare:npm From an advisory covering 2 CVEs |
3.7.0-tuxcare.0 up to 3.7.0-tuxcare.1, plus listed versions 3.7.0 |
3.7.0-tuxcare.1 |
js-yamlTuxCare:npm From an advisory covering 2 CVEs |
4.1.0-tuxcare.0 up to 4.1.0-tuxcare.1, plus listed versions 4.1.0 |
4.1.0-tuxcare.1 |
js-yamlTuxCare:npm From an advisory covering 2 CVEs |
3.14.1-tuxcare.0 up to 3.14.1-tuxcare.1, plus listed versions 3.14.1 |
3.14.1-tuxcare.1 |
js-yamlTuxCare:npm From an advisory covering 4 CVEs |
3.13.1-tuxcare.0 up to 3.13.1-tuxcare.1, plus listed versions 3.13.1 |
3.13.1-tuxcare.1 |
node-js-yamlDebian:12 |
All versions, plus listed versions 4.1.0+dfsg+~4.0.5-74.1.1+dfsg+~4.0.9-14.2.0+~4.0.9-14.2.0+~4.0.9-24.3.2+~4.0.9-1 |
None known |
Show 29 moreShow less
| Package | Affected | Fixed |
|---|---|---|
node-js-yamlDebian:13 |
All versions, plus listed versions 4.1.0+dfsg+~4.0.5-74.1.1+dfsg+~4.0.9-14.2.0+~4.0.9-14.2.0+~4.0.9-24.3.2+~4.0.9-1 |
None known |
node-js-yamlDebian:14 |
before 4.1.1+dfsg+~4.0.9-1, plus listed versions 4.1.0+dfsg+~4.0.5-7 |
4.1.1+dfsg+~4.0.9-1 |
nodejs-js-yamlopenEuler:24.03-LTS-SP2 |
before 3.10.0-2.oe2403sp2 | 3.10.0-2.oe2403sp2 |
nodejs-js-yamlopenEuler:20.03-LTS-SP4 |
before 3.10.0-2.oe2003sp4 | 3.10.0-2.oe2003sp4 |
nodejs-js-yamlopenEuler:22.03-LTS-SP3 |
before 3.10.0-2.oe2203sp3 | 3.10.0-2.oe2203sp3 |
nodejs-js-yamlopenEuler:22.03-LTS-SP4 |
before 3.10.0-2.oe2203sp4 | 3.10.0-2.oe2203sp4 |
nodejs-js-yamlopenEuler:24.03-LTS |
before 3.10.0-2.oe2403 | 3.10.0-2.oe2403 |
nodejs-js-yamlopenEuler:24.03-LTS-SP1 |
before 3.10.0-2.oe2403sp1 | 3.10.0-2.oe2403sp1 |
js-yamlRoot:npm |
before 3.14.1-aikido.6 | 3.14.1-aikido.64.1.0-aikido.63.14.1-aikido.24.1.0-aikido.23.13.1-aikido.23.14.1-aikido.34.1.0-aikido.33.14.1-aikido.44.1.0-aikido.43.13.1-aikido.43.14.1-aikido.54.1.0-aikido.53.13.1-aikido.33.14.2-aikido.44.1.1-aikido.44.1.1-aikido.13.14.2-aikido.14.1.1-aikido.23.14.2-aikido.23.14.2-aikido.34.1.1-aikido.34.1.1-aikido.5 |
@rootio/js-yamlRoot:npm |
before 3.13.1-root.io.1 | 3.13.1-root.io.13.14.1-root.io.14.1.0-root.io.13.14.1-root.io.64.1.0-root.io.63.14.1-root.io.24.1.0-root.io.23.13.1-root.io.23.14.1-root.io.34.1.0-root.io.33.14.1-root.io.44.1.0-root.io.43.13.1-root.io.43.14.1-root.io.54.1.0-root.io.53.13.1-root.io.33.14.2-root.io.44.1.1-root.io.44.1.1-root.io.13.14.2-root.io.14.1.1-root.io.23.14.2-root.io.23.14.2-root.io.34.1.1-root.io.34.1.1-root.io.5 |
js-yamlRoot:npm |
before 3.7.0-aikido.2 | 3.7.0-aikido.23.13.1-aikido.23.13.1-aikido.43.13.1-aikido.3 |
@rootio/js-yamlRoot:npm |
before 3.7.0-root.io.2 | 3.7.0-root.io.23.13.1-root.io.13.13.1-root.io.23.13.1-root.io.43.13.1-root.io.3 |
cockpit-subscriptionsSUSE:Linux Micro 6.2 |
before 12.1-160000.1.1 | 12.1-160000.1.1 |
cockpit-subscriptionsSUSE:Linux Enterprise Server 16.0 |
before 12.1-160000.1.1 | 12.1-160000.1.1 |
cockpit-subscriptionsSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 12.1-160000.1.1 | 12.1-160000.1.1 |
cockpit-reposSUSE:Linux Micro 6.2 From an advisory covering 2 CVEs |
before 4.7-160000.1.1 | 4.7-160000.1.1 |
cockpit-reposSUSE:Linux Enterprise Server 16.0 From an advisory covering 2 CVEs |
before 4.7-160000.1.1 | 4.7-160000.1.1 |
cockpit-reposSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 2 CVEs |
before 4.7-160000.1.1 | 4.7-160000.1.1 |
node-js-yamlUbuntu:18.04:LTS |
All versions, plus listed versions 3.9.1+dfsg-13.10.0+dfsg-1 |
None known |
node-js-yamlUbuntu:20.04:LTS |
All versions, plus listed versions 3.13.1+dfsg-2 |
None known |
node-js-yamlUbuntu:22.04:LTS |
All versions, plus listed versions 3.14.1+dfsg+~3.12.6-24.1.0+dfsg+~4.0.5-4ubuntu14.1.0+dfsg+~4.0.5-54.1.0+dfsg+~4.0.5-6 |
None known |
node-js-yamlUbuntu:24.04:LTS |
All versions, plus listed versions 4.1.0+dfsg+~4.0.5-7 |
None known |
node-js-yamlUbuntu:25.10 |
All versions, plus listed versions 4.1.0+dfsg+~4.0.5-7 |
None known |
node-js-yamlUbuntu:26.10 |
All versions, plus listed versions 4.1.1+dfsg+~4.0.9-14.2.0+~4.0.9-14.2.0+~4.0.9-2 |
None known |
node-js-yamlUbuntu:26.04:LTS |
All versions, plus listed versions 4.1.0+dfsg+~4.0.5-74.1.1+dfsg+~4.0.9-1 |
None known |
cockpit-reposopenSUSE:Tumbleweed |
before 4.6-1.1 | 4.6-1.1 |
velociraptoropenSUSE:Tumbleweed From an advisory covering 49 CVEs |
before 0.7.0.4.git185.a5708584-2.1 | 0.7.0.4.git185.a5708584-2.1 |
cockpit-subscriptionsopenSUSE:Leap 16.0 |
before 12.1-160000.1.1 | 12.1-160000.1.1 |
cockpit-reposopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 4.7-160000.1.1 | 4.7-160000.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-64718 is a medium vulnerability (CVSS 5.3) in Nodeca Js-yaml, published June 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in js-yaml 3.13.0.
References
github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m
Show 76 moreShow less
npmjs.com/advisories/788
snyk.io/vuln/SNYK-JS-JSYAML-173999
nvd.nist.gov/vuln/detail/CVE-2025-64718
security-tracker.debian.org/tracker/CVE-2025-64718
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-1166
suse.com/support/update/announcement/2026/suse-su-202620170-1
bugzilla.suse.com/1255425
ubuntu.com/security/CVE-2025-64718
cve.org/CVERecord?id=CVE-2025-64718