{"id":"CVE-2025-64718","aliases":["CLSA-2026-1773965915","CLSA-2026-1774570935","CLSA-2026-1778805968","CLSA-2026-1781484837","CLSA-2026-1790963665","DEBIAN-CVE-2025-64718","EUVD-2025-175314","GHSA-2pr6-76vf-7546","GHSA-5p4m-2wfm-xmqj","GHSA-8j8c-7jfh-h6hx","GHSA-mh29-5h37-fv8m","OESA-2026-1166","OESA-2026-1167","OESA-2026-1168","OESA-2026-1169","OESA-2026-1170","OESA-2026-1171","ROOT-APP-NPM-CVE-2025-64718","ROOT-APP-NPM-GHSA-8j8c-7jfh-h6hx","SUSE-SU-2026:20170-1","SUSE-SU-2026:20182-1","SUSE-SU-2026:20540-1","SUSE-SU-2026:20580-1","UBUNTU-CVE-2025-64718","openSUSE-SU-2026:10036-1","openSUSE-SU-2026:11126-1","openSUSE-SU-2026:20117-1","openSUSE-SU-2026:20251-1"],"status":"published","title":"js-yaml has prototype pollution in merge (\u003c\u003c)","description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00423,"percentile":0.37055,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321","CWE-400","CWE-94"],"published":"2019-06-04T20:14:07Z","modified":"2026-10-28T02:30:28Z","fixes":[{"ecosystem":"npm","package":"js-yaml","fixed_in":["3.13.0","3.13.1","4.1.1","3.14.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"js-yaml","fixed_in":["3.3.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-js-yaml","fixed_in":["4.1.1+dfsg+~4.0.9-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"nodejs-js-yaml","fixed_in":["3.10.0-2.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"nodejs-js-yaml","fixed_in":["3.10.0-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"nodejs-js-yaml","fixed_in":["3.10.0-2.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"nodejs-js-yaml","fixed_in":["3.10.0-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"nodejs-js-yaml","fixed_in":["3.10.0-2.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"nodejs-js-yaml","fixed_in":["3.10.0-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"js-yaml","fixed_in":["3.14.1-aikido.6","4.1.0-aikido.6","3.14.1-aikido.2","4.1.0-aikido.2","3.13.1-aikido.2","3.14.1-aikido.3","4.1.0-aikido.3","3.14.1-aikido.4","4.1.0-aikido.4","3.13.1-aikido.4","3.14.1-aikido.5","4.1.0-aikido.5","3.13.1-aikido.3","3.14.2-aikido.4","4.1.1-aikido.4","4.1.1-aikido.1","3.14.2-aikido.1","4.1.1-aikido.2","3.14.2-aikido.2","3.14.2-aikido.3","4.1.1-aikido.3","4.1.1-aikido.5","3.7.0-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/js-yaml","fixed_in":["3.13.1-root.io.1","3.14.1-root.io.1","4.1.0-root.io.1","3.14.1-root.io.6","4.1.0-root.io.6","3.14.1-root.io.2","4.1.0-root.io.2","3.13.1-root.io.2","3.14.1-root.io.3","4.1.0-root.io.3","3.14.1-root.io.4","4.1.0-root.io.4","3.13.1-root.io.4","3.14.1-root.io.5","4.1.0-root.io.5","3.13.1-root.io.3","3.14.2-root.io.4","4.1.1-root.io.4","4.1.1-root.io.1","3.14.2-root.io.1","4.1.1-root.io.2","3.14.2-root.io.2","3.14.2-root.io.3","4.1.1-root.io.3","4.1.1-root.io.5","3.7.0-root.io.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"cockpit-subscriptions","fixed_in":["12.1-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cockpit-subscriptions","fixed_in":["12.1-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cockpit-subscriptions","fixed_in":["12.1-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cockpit-repos","fixed_in":["4.6-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"cockpit-subscriptions","fixed_in":["12.1-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.1.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.1-tuxcare.0"},{"fixed":"3.3.1-tuxcare.1"}]}],"versions":["3.3.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.0-tuxcare.0"},{"fixed":"3.7.0-tuxcare.1"}]}],"versions":["3.7.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0-tuxcare.0"},{"fixed":"4.1.0-tuxcare.1"}]}],"versions":["4.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.14.1-tuxcare.0"},{"fixed":"3.14.1-tuxcare.1"}]}],"versions":["3.14.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.13.1-tuxcare.0"},{"fixed":"3.13.1-tuxcare.1"}]}],"versions":["3.13.1"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0+dfsg+~4.0.5-7","4.1.1+dfsg+~4.0.9-1","4.2.0+~4.0.9-1","4.2.0+~4.0.9-2","4.3.2+~4.0.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0+dfsg+~4.0.5-7","4.1.1+dfsg+~4.0.9-1","4.2.0+~4.0.9-1","4.2.0+~4.0.9-2","4.3.2+~4.0.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1+dfsg+~4.0.9-1"}]}],"versions":["4.1.0+dfsg+~4.0.5-7"]},{"source":"osv","ecosystem":"npm","package":"js-yaml","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.13.0"}]}]},{"source":"osv","ecosystem":"npm","package":"js-yaml","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.13.1"}]}]},{"source":"osv","ecosystem":"npm","package":"js-yaml","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.1.1"}]}]},{"source":"osv","ecosystem":"npm","package":"js-yaml","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.14.2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"nodejs-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-2.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"nodejs-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"nodejs-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"nodejs-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"nodejs-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nodejs-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.1-aikido.6"},{"fixed":"4.1.0-aikido.6"},{"fixed":"3.14.1-aikido.2"},{"fixed":"4.1.0-aikido.2"},{"fixed":"3.13.1-aikido.2"},{"fixed":"3.14.1-aikido.3"},{"fixed":"4.1.0-aikido.3"},{"fixed":"3.14.1-aikido.4"},{"fixed":"4.1.0-aikido.4"},{"fixed":"3.13.1-aikido.4"},{"fixed":"3.14.1-aikido.5"},{"fixed":"4.1.0-aikido.5"},{"fixed":"3.13.1-aikido.3"},{"fixed":"3.14.2-aikido.4"},{"fixed":"4.1.1-aikido.4"},{"fixed":"4.1.1-aikido.1"},{"fixed":"3.14.2-aikido.1"},{"fixed":"4.1.1-aikido.2"},{"fixed":"3.14.2-aikido.2"},{"fixed":"3.14.2-aikido.3"},{"fixed":"4.1.1-aikido.3"},{"fixed":"4.1.1-aikido.5"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-root.io.1"},{"fixed":"3.14.1-root.io.1"},{"fixed":"4.1.0-root.io.1"},{"fixed":"3.14.1-root.io.6"},{"fixed":"4.1.0-root.io.6"},{"fixed":"3.14.1-root.io.2"},{"fixed":"4.1.0-root.io.2"},{"fixed":"3.13.1-root.io.2"},{"fixed":"3.14.1-root.io.3"},{"fixed":"4.1.0-root.io.3"},{"fixed":"3.14.1-root.io.4"},{"fixed":"4.1.0-root.io.4"},{"fixed":"3.13.1-root.io.4"},{"fixed":"3.14.1-root.io.5"},{"fixed":"4.1.0-root.io.5"},{"fixed":"3.13.1-root.io.3"},{"fixed":"3.14.2-root.io.4"},{"fixed":"4.1.1-root.io.4"},{"fixed":"4.1.1-root.io.1"},{"fixed":"3.14.2-root.io.1"},{"fixed":"4.1.1-root.io.2"},{"fixed":"3.14.2-root.io.2"},{"fixed":"3.14.2-root.io.3"},{"fixed":"4.1.1-root.io.3"},{"fixed":"4.1.1-root.io.5"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0-aikido.2"},{"fixed":"3.13.1-aikido.2"},{"fixed":"3.13.1-aikido.4"},{"fixed":"3.13.1-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0-root.io.2"},{"fixed":"3.13.1-root.io.1"},{"fixed":"3.13.1-root.io.2"},{"fixed":"3.13.1-root.io.4"},{"fixed":"3.13.1-root.io.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cockpit-subscriptions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.1-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cockpit-subscriptions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.1-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cockpit-subscriptions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.1-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cockpit-repos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cockpit-repos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cockpit-repos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.1+dfsg-1","3.10.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.13.1+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.1+dfsg+~3.12.6-2","4.1.0+dfsg+~4.0.5-4ubuntu1","4.1.0+dfsg+~4.0.5-5","4.1.0+dfsg+~4.0.5-6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0+dfsg+~4.0.5-7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0+dfsg+~4.0.5-7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+dfsg+~4.0.9-1","4.2.0+~4.0.9-1","4.2.0+~4.0.9-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0+dfsg+~4.0.5-7","4.1.1+dfsg+~4.0.9-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cockpit-repos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.4.git185.a5708584-2.1"}]}],"bundled":49},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cockpit-subscriptions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.1-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cockpit-repos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7-160000.1.1"}]}],"bundled":2}],"products":[{"vendor":"nodeca","product":"js-yaml"}],"references":[{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876","tags":["x_refsource_MISC","Issue Tracking","report","web"]},{"url":"https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","tags":["Vendor Advisory","advisory"]},{"url":"https://github.com/nodeca/js-yaml/issues/475","tags":["web"]},{"url":"https://github.com/nodeca/js-yaml/commit/a567ef3c6e61eb319f0bfc2671d91061afb01235","tags":["web"]},{"url":"https://www.npmjs.com/advisories/788","tags":["web"]},{"url":"https://www.npmjs.com/advisories/788/versions","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-JSYAML-173999","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2pr6-76vf-7546"},{"url":"https://github.com/nodeca/js-yaml/pull/480","tags":["web"]},{"url":"https://www.npmjs.com/advisories/813","tags":["web"]},{"url":"https://github.com/nodeca/js-yaml/pull/480/commits/e18afbf1edcafb7add2c4c7b22abc8d6ebc2fa61","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8j8c-7jfh-h6hx"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64718","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64718.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-64718","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1166","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1167","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1168","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1169","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1170","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1171","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620170-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1255425","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64718","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620182-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620540-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257325","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13465","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620580-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-64718","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-64718","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-64718","title":"js-yaml has prototype pollution in merge (\u003c\u003c)","description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","status":"published","published":"2025-11-13T15:32:44.634Z","modified":"2026-01-29T22:08:30.431Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:32:46.750177Z"}],"euvd":[{"id":"EUVD-2025-175314","description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","status":"published","published":"2025-11-13T15:32:44Z","modified":"2026-01-29T22:08:30Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:45.464917Z"}],"ghsa":[{"id":"GHSA-2pr6-76vf-7546","title":"Denial of Service in js-yaml","description":"Versions of `js-yaml` prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.\n\n\n## Recommendation\n\nUpgrade to version 3.13.0.","status":"published","published":"2019-06-05T14:35:29Z","modified":"2023-01-09T05:01:39Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:02.073372Z"},{"id":"GHSA-mh29-5h37-fv8m","title":"js-yaml has prototype pollution in merge (\u003c\u003c)","description":"### Impact\n\nIn js-yaml 4.1.0, 4.0.0, and 3.14.1 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted.\n\n### Patches\n\nProblem is patched in js-yaml 4.1.1 and 3.14.2.\n\n### Workarounds\n\nYou can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).\n\n### References\n\nhttps://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html","status":"published","published":"2025-11-14T14:29:48Z","modified":"2026-01-31T03:32:45Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:39:20.563096Z"},{"id":"GHSA-8j8c-7jfh-h6hx","title":"Code Injection in js-yaml","description":"Versions of `js-yaml` prior to 3.13.1 are vulnerable to Code Injection. The `load()` function may execute arbitrary code injected through a malicious YAML file. Objects that have `toString` as key, JavaScript code as value and are used as explicit mapping keys allow attackers to execute the supplied code through the `load()` function. The `safeLoad()` function is unaffected.\n\nAn example payload is \n`{ toString: !\u003ctag:yaml.org,2002:js/function\u003e 'function (){return Date.now()}' } : 1` \nwhich returns the object \n{\n  \"1553107949161\": 1\n}\n\n\n## Recommendation\n\nUpgrade to version 3.13.1.","status":"published","published":"2019-06-04T20:14:07Z","modified":"2023-11-29T20:43:52Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:37:23.843848Z"}],"nvd":[{"id":"CVE-2025-64718","description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","status":"published","published":"2025-11-13T16:15:57.153Z","modified":"2026-10-07T21:10:00.2Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:11:43.650381Z"}],"osv":[{"id":"CVE-2025-64718","title":"js-yaml has prototype pollution in merge (\u003c\u003c)","description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","status":"published","published":"2025-11-13T15:32:44.634Z","modified":"2026-10-28T02:30:28.663094996Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:44:51.851511Z"},{"id":"DEBIAN-CVE-2025-64718","description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","status":"published","published":"2025-11-13T16:15:57.153Z","modified":"2026-10-08T10:00:26.990344755Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"GHSA-2pr6-76vf-7546","title":"Denial of Service in js-yaml","description":"Versions of `js-yaml` prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.\n\n\n## Recommendation\n\nUpgrade to version 3.13.0.","status":"published","published":"2019-06-05T14:35:29Z","modified":"2021-08-04T21:32:56Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"GHSA-mh29-5h37-fv8m","title":"js-yaml has prototype pollution in merge (\u003c\u003c)","description":"### Impact\n\nIn js-yaml 4.1.0, 4.0.0, and 3.14.1 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted.\n\n### Patches\n\nProblem is patched in js-yaml 4.1.1 and 3.14.2.\n\n### Workarounds\n\nYou can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).\n\n### References\n\nhttps://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html","status":"published","published":"2025-11-14T14:29:48Z","modified":"2026-09-10T03:50:58.46912691Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:51.811331Z"},{"id":"OESA-2026-1166","title":"nodejs-js-yaml security update","description":"This is an implementation of YAML (YAML Ain\u0026amp;apos;t Markup Language), a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch.  Now it\u0026amp;apos;s very fast, and supports the 1.2 spec.\r\n\r\nSecurity Fix(es):\n\njs-yaml is a JavaScript YAML parser and dumper. In js-yaml 4.1.0 and below, it\u0026apos;s possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).(CVE-2025-64718)","status":"published","published":"2026-01-16T11:10:12Z","modified":"2026-08-18T01:19:28.443764524Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1167","title":"nodejs-js-yaml security update","description":"This is an implementation of YAML (YAML Ain\u0026amp;apos;t Markup Language), a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch.  Now it\u0026amp;apos;s very fast, and supports the 1.2 spec.\r\n\r\nSecurity Fix(es):\n\njs-yaml is a JavaScript YAML parser and dumper. In js-yaml 4.1.0 and below, it\u0026apos;s possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).(CVE-2025-64718)","status":"published","published":"2026-01-16T11:10:12Z","modified":"2026-08-18T01:19:28.889153772Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1168","title":"nodejs-js-yaml security update","description":"This is an implementation of YAML (YAML Ain\u0026amp;apos;t Markup Language), a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch.  Now it\u0026amp;apos;s very fast, and supports the 1.2 spec.\r\n\r\nSecurity Fix(es):\n\njs-yaml is a JavaScript YAML parser and dumper. In js-yaml 4.1.0 and below, it\u0026apos;s possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).(CVE-2025-64718)","status":"published","published":"2026-01-16T11:10:12Z","modified":"2026-08-18T01:19:28.328516244Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1169","title":"nodejs-js-yaml security update","description":"This is an implementation of YAML (YAML Ain\u0026amp;apos;t Markup Language), a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch.  Now it\u0026amp;apos;s very fast, and supports the 1.2 spec.\r\n\r\nSecurity Fix(es):\n\njs-yaml is a JavaScript YAML parser and dumper. In js-yaml 4.1.0 and below, it\u0026apos;s possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).(CVE-2025-64718)","status":"published","published":"2026-01-16T11:10:12Z","modified":"2026-08-18T01:19:28.322787327Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1170","title":"nodejs-js-yaml security update","description":"This is an implementation of YAML (YAML Ain\u0026amp;apos;t Markup Language), a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch.  Now it\u0026amp;apos;s very fast, and supports the 1.2 spec.\r\n\r\nSecurity Fix(es):\n\njs-yaml is a JavaScript YAML parser and dumper. In js-yaml 4.1.0 and below, it\u0026apos;s possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).(CVE-2025-64718)","status":"published","published":"2026-01-16T11:10:12Z","modified":"2026-08-18T01:19:29.044243071Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1171","title":"nodejs-js-yaml security update","description":"This is an implementation of YAML (YAML Ain\u0026amp;apos;t Markup Language), a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch.  Now it\u0026amp;apos;s very fast, and supports the 1.2 spec.\r\n\r\nSecurity Fix(es):\n\njs-yaml is a JavaScript YAML parser and dumper. In js-yaml 4.1.0 and below, it\u0026apos;s possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).(CVE-2025-64718)","status":"published","published":"2026-01-16T11:10:12Z","modified":"2026-08-18T01:19:28.432134949Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"ROOT-APP-NPM-CVE-2025-64718","title":"CVE-2025-64718 in js-yaml - Patched by Root","description":"Root has patched CVE-2025-64718 in the js-yaml package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-08T12:20:34Z","modified":"2026-10-08T13:15:05.90496126Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"UBUNTU-CVE-2025-64718","description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","status":"published","published":"2025-11-13T16:15:00Z","modified":"2026-10-17T12:57:11.636274503Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:52.345622Z"},{"id":"CLSA-2026-1773965915","title":"TuxCare security update for js-yaml (3 CVEs)","description":"TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.3.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:47.25953929Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774570935","title":"TuxCare security update for js-yaml (5 CVEs)","description":"TuxCare rebuilt js-yaml to address 5 CVEs. Fixed in 3.7.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:04.374200791Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1778805968","title":"TuxCare security update for js-yaml (2 CVEs)","description":"TuxCare rebuilt js-yaml to address 2 CVEs. Fixed in 4.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-22T14:30:59.097615626Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1781484837","title":"TuxCare security update for js-yaml (3 CVEs)","description":"TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.14.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:47:51.285258513Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1790963665","title":"TuxCare security update for js-yaml (5 CVEs)","description":"TuxCare rebuilt js-yaml to address 5 CVEs. Fixed in 3.13.1-tuxcare.1.","status":"published","published":"2026-10-02T17:54:25Z","modified":"2026-10-15T09:47:38.645562221Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"GHSA-8j8c-7jfh-h6hx","title":"Code Injection in js-yaml","description":"Versions of `js-yaml` prior to 3.13.1 are vulnerable to Code Injection. The `load()` function may execute arbitrary code injected through a malicious YAML file. Objects that have `toString` as key, JavaScript code as value and are used as explicit mapping keys allow attackers to execute the supplied code through the `load()` function. The `safeLoad()` function is unaffected.\n\nAn example payload is \n`{ toString: !\u003ctag:yaml.org,2002:js/function\u003e 'function (){return Date.now()}' } : 1` \nwhich returns the object \n{\n  \"1553107949161\": 1\n}\n\n\n## Recommendation\n\nUpgrade to version 3.13.1.","status":"published","published":"2019-06-04T20:14:07Z","modified":"2020-08-31T18:36:43Z","cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"openSUSE-SU-2026:10036-1","title":"cockpit-repos-4.6-1.1 on GA media","description":"These are all security issues fixed in the cockpit-repos-4.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-13T00:00:00Z","modified":"2026-03-23T04:54:21.916312Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11126-1","title":"velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-25T00:00:00Z","modified":"2026-06-26T08:15:07.590096547Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:20117-1","title":"Security update for cockpit-subscriptions","description":"This update for cockpit-subscriptions fixes the following issues:\n\nUpdate to version 12.1:\n\n- CVE-2025-64718: js-yaml: fixed prototype pollution in merge (bsc#1255425).\n","status":"published","published":"2026-01-27T20:37:55Z","modified":"2026-03-23T04:54:44.538896Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20251-1","title":"Security update for cockpit-repos","description":"This update for cockpit-repos fixes the following issues:\n\nUpdate to version 4.7.\n\nSecurity issues fixed:\n\n- CVE-2025-13465: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from global\n  (bsc#1257325).\n- CVE-2025-64718: js-yaml prototype pollution in merge (bsc#1255425).\n\nOther updates and bugfixes:\n\n- version update to 4.7\n\n  * Translation updates\n\n- version update to 4.6:\n\n  * Translation updates\n  * Dependency updates\n  * Fix translations pot file not being update\n\n- version update to 4.5:\n\n  * Dependency updates\n\n- version update to 4.4:\n\n  * Translation updates\n  * Dependency updates\n","status":"published","published":"2026-02-18T11:22:31Z","modified":"2026-03-23T04:54:48.575108Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"ROOT-APP-NPM-GHSA-8j8c-7jfh-h6hx","title":"GHSA-8j8c-7jfh-h6hx in js-yaml - Patched by Root","description":"Root has patched GHSA-8j8c-7jfh-h6hx in the js-yaml package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-28T12:07:31Z","modified":"2026-09-28T13:15:05.662356766Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"SUSE-SU-2026:20170-1","title":"Security update for cockpit-subscriptions","description":"This update for cockpit-subscriptions fixes the following issues:\n\nUpdate to version 12.1:\n\n- CVE-2025-64718: js-yaml: fixed prototype pollution in merge (bsc#1255425).\n","status":"published","published":"2026-01-27T20:40:44Z","modified":"2026-03-23T04:52:40.666346Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20182-1","title":"Security update for cockpit-subscriptions","description":"This update for cockpit-subscriptions fixes the following issues:\n\nUpdate to version 12.1:\n\n- CVE-2025-64718: js-yaml: fixed prototype pollution in merge (bsc#1255425).\n","status":"published","published":"2026-01-27T20:40:44Z","modified":"2026-03-23T04:52:41.465524Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20540-1","title":"Security update for cockpit-repos","description":"This update for cockpit-repos fixes the following issues:\n\nUpdate to version 4.7.\n\nSecurity issues fixed:\n\n- CVE-2025-13465: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from global\n  (bsc#1257325).\n- CVE-2025-64718: js-yaml prototype pollution in merge (bsc#1255425).\n\nOther updates and bugfixes:\n\n- version update to 4.7\n\n  * Translation updates\n\n- version update to 4.6:\n\n  * Translation updates\n  * Dependency updates\n  * Fix translations pot file not being update\n\n- version update to 4.5:\n\n  * Dependency updates\n\n- version update to 4.4:\n\n  * Translation updates\n  * Dependency updates\n","status":"published","published":"2026-02-18T11:27:28Z","modified":"2026-03-23T04:53:02.534769Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20580-1","title":"Security update for cockpit-repos","description":"This update for cockpit-repos fixes the following issues:\n\nUpdate to version 4.7.\n\nSecurity issues fixed:\n\n- CVE-2025-13465: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from global\n  (bsc#1257325).\n- CVE-2025-64718: js-yaml prototype pollution in merge (bsc#1255425).\n\nOther updates and bugfixes:\n\n- version update to 4.7\n\n  * Translation updates\n\n- version update to 4.6:\n\n  * Translation updates\n  * Dependency updates\n  * Fix translations pot file not being update\n\n- version update to 4.5:\n\n  * Dependency updates\n\n- version update to 4.4:\n\n  * Translation updates\n  * Dependency updates\n","status":"published","published":"2026-02-18T11:27:28Z","modified":"2026-03-23T04:52:50.064041Z","updated_at":"2026-11-02T15:54:01.953589Z"}]}}