js-yaml has prototype pollution in merge (<<)

Prototype pollution occurs when an attacker can modify the prototype of JavaScript objects, effectively altering the behavior of all objects inheriting from that prototype. In the context of js-yaml, an attacker can exploit this vulnerability by crafting malicious YAML input that leverages the proto property to inject arbitrary properties into the prototype. This can lead to denial-of-service, information disclosure, or even remote code execution if the polluted prototype is used in sensitive operations. The impact is particularly severe for applications that parse untrusted YAML data, as they are directly exposed to this attack vector. Successful exploitation could allow an attacker to manipulate application logic or gain unauthorized access to resources.

Applications built with Node.js or Deno that utilize the js-yaml library to parse YAML data from untrusted sources are at risk. This includes applications that process configuration files, data feeds, or user-supplied input in YAML format. Shared hosting environments where multiple applications share the same Node.js installation are particularly vulnerable, as a compromise in one application could affect others.

• nodejs:

  ps aux | grep 'node --disable-proto=delete'

• nodejs: Check for js-yaml versions prior to 4.1.1 or 3.14.2 using npm list js-yaml. • generic web: Examine application logs for unusual object properties or unexpected behavior after parsing YAML data.

1. 2025-11-14Disclosure

   disclosure

最后更新

4.1.16个月前

1. 已保留2025-11-10
2. 发布日期2025-11-14
3. 修改日期2026-02-04
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-64718 is to upgrade to js-yaml version 4.1.1 or 3.14.2. If immediate upgrading is not feasible, consider using the --disable-proto=delete flag when running Node.js, which disables prototype pollution. Deno provides built-in protection against prototype pollution by default, so applications running in Deno are inherently less vulnerable. Additionally, carefully validate and sanitize all YAML input to prevent malicious data from being parsed. Regularly review and update dependencies to ensure you are using the latest secure versions of all libraries.