CVE-2013-4660
NoneCVSS
—
EPSS
17.3%
Published
Jun 28, 2013
CISA due date
—
The record
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | js-yaml | 0 | 2.0.5 |
Related vulnerabilities
- CVE-2026-53550 js-yaml is a JavaScript YAML parser and dumper. Also affects js-yaml
- GHSA-h67p-54hq-rp68 JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases Also affects js-yaml
- GHSA-mh29-5h37-fv8m js-yaml has prototype pollution in merge (<<) Also affects js-yaml
- CVE-2025-64718 js-yaml is a JavaScript YAML parser and dumper. Also affects js-yaml
- GHSA-2pr6-76vf-7546 Denial of Service in js-yaml Also affects js-yaml
- GHSA-8j8c-7jfh-h6hx Code Injection in js-yaml Also affects js-yaml
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-20
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-20