The JS-YAML module prior to 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote malicious users to execute arbitrary code via a crafted string that triggers an eval operation.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
js-yaml project js-yaml 0.2.2 |
||
js-yaml project js-yaml 0.3.1 |
||
js-yaml project js-yaml 1.0.0 |
||
js-yaml project js-yaml 1.0.2 |
||
js-yaml project js-yaml 2.0.3 |
||
js-yaml project js-yaml 0.2.0 |
||
js-yaml project js-yaml 0.2.1 |
||
js-yaml project js-yaml 1.0.3 |
||
js-yaml project js-yaml 2.0.0 |
||
js-yaml project js-yaml 2.0.1 |
||
js-yaml project js-yaml 2.0.2 |
||
js-yaml project js-yaml 0.3.3 |
||
js-yaml project js-yaml 0.3.4 |
||
js-yaml project js-yaml 0.3.5 |
||
js-yaml project js-yaml 0.3.6 |
||
js-yaml project js-yaml 0.3.0 |
||
js-yaml project js-yaml 0.3.2 |
||
js-yaml project js-yaml 0.3.7 |
||
js-yaml project js-yaml 1.0.1 |
||
js-yaml project js-yaml |
Vulmon