VDB
DEBIAN-CVE-2025-64718
DEBIAN-CVE-2025-64718
PUBLISHED
CVSS 5.300000190734863 MEDIUM
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).
Risk Scores
CVSS v3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:14 | node-js-yaml | 0, 4.1.0+dfsg+~4.0.5-7, 0 |
| Debian:12 | node-js-yaml | 4.1.1+dfsg, 0, 4.1.0+dfsg+~4.0.5-7 |
| Debian:11 | node-js-yaml | 4.1.0+dfsg+~4.0.5-7, 4.1.1+dfsg+~4.0.9-1, 0 |
| Debian:13 | node-js-yaml | 0, 4.1.0+dfsg+~4.0.5-7, 4.1.1+dfsg+~4.0.9-1 |
Timeline
- Nov 13, 2025 CVE Published
- Apr 28, 2026 CVE Updated