GHSA-mh29-5h37-fv8m
Medium · 5.3CVSS
5.3
EPSS
—
Published
Nov 14, 2025
CISA due date
—
The record
js-yaml has prototype pollution in merge (<<)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | js-yaml | 0 | 3.14.2 |
| npm | js-yaml | 4.0.0 | 4.1.1 |
| Chainguard | arangodb-3.11 | 0 | 3.11.14.1-r7 |
| Chainguard | arangodb-3.11-compat | 0 | 3.11.14.1-r7 |
| Chainguard | arangodb-3.12 | 0 | 3.12.6.1-r1 |
| Chainguard | arangodb-3.12-compat | 0 | 3.12.6.1-r1 |
| Chainguard | argo-workflow-cli-3.6 | 0 | 3.6.13-r1 |
| Chainguard | argo-workflow-cli-3.7 | 0 | 3.7.4-r1 |
| Chainguard | argo-workflow-controller-3.6 | 0 | 3.6.13-r1 |
| Chainguard | argo-workflow-controller-3.6-compat | 0 | 3.6.13-r1 |
| Chainguard | argo-workflow-controller-3.7 | 0 | 3.7.4-r1 |
| Chainguard | argo-workflow-controller-3.7-compat | 0 | 3.7.4-r1 |
| Chainguard | argo-workflow-executor-3.6 | 0 | 3.6.13-r1 |
| Chainguard | argo-workflow-executor-3.6-compat | 0 | 3.6.13-r1 |
| Chainguard | argo-workflow-executor-3.7 | 0 | 3.7.4-r1 |
| Chainguard | argo-workflow-executor-3.7-compat | 0 | 3.7.4-r1 |
| Chainguard | argo-workflows-3.6 | 0 | 3.6.13-r1 |
| Chainguard | argo-workflows-3.7 | 0 | 3.7.4-r1 |
| Chainguard | argo-workflows-known-hosts-3.6 | 0 | 3.6.13-r1 |
| Chainguard | argo-workflows-known-hosts-3.7 | 0 | 3.7.4-r1 |
| Chainguard | argo-workflows-ui-3.6 | 0 | 3.6.13-r1 |
| Chainguard | argo-workflows-ui-3.7 | 0 | 3.7.4-r1 |
| Chainguard | code-server | 0 | 4.106.2-r0 |
| Chainguard | code-server-compat | 0 | 4.106.2-r0 |
| Chainguard | eslint | 0 | 9.39.1-r1 |
| Chainguard | jitsucom-jitsu | 0 | 2.11.0-r7 |
| Chainguard | jitsucom-jitsu-console | 0 | 2.11.0-r7 |
| Chainguard | jitsucom-jitsu-rotor | 0 | 2.11.0-r7 |
| Chainguard | kibana-7 | 0 | 7.17.29-r6 |
| Chainguard | kibana-7-bitnami | 0 | 7.17.29-r6 |
| Chainguard | kibana-8.17 | 0 | 8.17.10-r3 |
| Chainguard | kibana-8.17-bitnami | 0 | 8.17.10-r3 |
| Chainguard | kibana-8.17-iamguarded | 0 | 8.17.10-r3 |
| Chainguard | kibana-8.18 | 0 | 8.18.8-r2 |
| Chainguard | kibana-8.18-bitnami | 0 | 8.18.8-r2 |
| Chainguard | kibana-8.18-iamguarded | 0 | 8.18.8-r2 |
| Chainguard | kibana-8.19 | 0 | 8.19.7-r1 |
| Chainguard | kibana-8.19-bitnami | 0 | 8.19.7-r1 |
| Chainguard | kibana-8.19-iamguarded | 0 | 8.19.7-r1 |
| Chainguard | kibana-9.0 | 0 | 9.0.8-r2 |
| Chainguard | kibana-9.0-bitnami | 0 | 9.0.8-r2 |
| Chainguard | kibana-9.0-iamguarded | 0 | 9.0.8-r2 |
| Chainguard | kibana-9.1 | 0 | 9.1.7-r1 |
| Chainguard | kibana-9.1-bitnami | 0 | 9.1.7-r1 |
| Chainguard | kibana-9.1-iamguarded | 0 | 9.1.7-r1 |
| Chainguard | kibana-9.2 | 0 | 9.2.1-r1 |
| Chainguard | kibana-9.2-iamguarded | 0 | 9.2.1-r1 |
| Chainguard | kubeflow-centraldashboard | 0 | 1.10.0-r10 |
| Chainguard | kubeflow-pipelines | 0 | 2.14.4-r1 |
| Chainguard | kubeflow-pipelines-apiserver | 0 | 2.14.4-r1 |
| Chainguard | kubeflow-pipelines-cache-deployer | 0 | 2.14.4-r1 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 0 | 2.14.4-r1 |
| Chainguard | kubeflow-pipelines-cache_server | 0 | 2.14.4-r1 |
| Chainguard | kubeflow-pipelines-frontend | 0 | 2.14.4-r1 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 0 | 2.14.4-r1 |
| Chainguard | kubeflow-pipelines-metadata-writer | 0 | 2.14.4-r1 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 0 | 2.14.4-r1 |
| Chainguard | kubeflow-pipelines-persistence_agent | 0 | 2.14.4-r1 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 0 | 2.14.4-r1 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 0 | 2.14.4-r1 |
| Chainguard | langfuse | 0 | 3.134.0-r0 |
| Chainguard | langfuse-compat | 0 | 3.134.0-r0 |
| Chainguard | langfuse-worker | 0 | 3.134.0-r0 |
| Chainguard | lerna | 0 | 9.0.1-r1 |
| Chainguard | librechat | 0 | 0.8.0-r4 |
| Chainguard | librechat-compat | 0 | 0.8.0-r4 |
| Chainguard | librechat-dev | 0 | 0.8.0-r4 |
| Chainguard | opensearch-dashboards-2 | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-compat | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-config | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-maps | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-notifications | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-observability | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-query-workbench | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-search-relevance | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-visualizations | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-fips | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-fips-alerting-dashboards-plugin | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-fips-config | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-maps | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-notifications | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-observability | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-query-workbench | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-reporting | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-search-relevance | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-visualizations | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-fips-index-management-dashboards-plugin | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-fips-ml-commons-dashboards | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-fips-security-analytics-dashboards-plugin | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-fips-security-dashboards-plugin | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-ml-commons-dashboards | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-2-security-dashboards-plugin | 0 | 2.19.4-r1 |
| Chainguard | opensearch-dashboards-3 | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-alerting-dashboards-plugin | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-config | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-dashboards-maps | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-dashboards-notifications | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-dashboards-observability | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-dashboards-query-workbench | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-dashboards-reporting | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-dashboards-search-relevance | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-fips | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-alerting-dashboards-plugin | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-config | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-maps | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-notifications | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-observability | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-query-workbench | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-reporting | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-search-relevance | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-index-management-dashboards-plugin | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-ml-commons-dashboards | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-security-analytics-dashboards-plugin | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-security-dashboards-plugin | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-index-management-dashboards-plugin | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-ml-commons-dashboards | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-security-analytics-dashboards-plugin | 0 | 3.2.0-r1 |
| Chainguard | opensearch-dashboards-3-security-dashboards-plugin | 0 | 3.2.0-r1 |
| Chainguard | prism | 0 | 5.14.3-r1 |
| Chainguard | pulumi | 0 | 3.209.0-r0 |
| Chainguard | pulumi-language-go | 0 | 3.209.0-r0 |
| Chainguard | pulumi-language-nodejs | 0 | 3.209.0-r0 |
| Chainguard | pulumi-language-python | 0 | 3.209.0-r0 |
| Chainguard | redisinsight | 0 | 2.70.1-r4 |
| Chainguard | redisinsight-docker-entrypoint | 0 | 2.70.1-r4 |
| Chainguard | renovate | 0 | 42.26.0-r0 |
| Chainguard | saf | 0 | 1.5.2-r0 |
| Chainguard | thingsboard | 0 | 4.2.1-r8 |
| Chainguard | thingsboard-tb-js-executor | 0 | 4.2.1-r8 |
| Chainguard | thingsboard-tb-mqtt-transport | 0 | 4.2.1-r8 |
| Chainguard | thingsboard-tb-node | 0 | 4.2.1-r8 |
| Chainguard | thingsboard-tb-web-ui | 0 | 4.2.1-r8 |
| Chainguard | tileserver-gl | 0 | 5.4.0-r4 |
| Chainguard | tileserver-gl-compat | 0 | 5.4.0-r4 |
| Chainguard | tileserver-gl-fips | 0 | 5.4.0-r4 |
| Chainguard | tileserver-gl-fips-compat | 0 | 5.4.0-r4 |
| Chainguard | vitess-20 | 0 | 20.0.8-r10 |
| Chainguard | vitess-20-binaries | 0 | 20.0.8-r10 |
| Chainguard | vitess-20-compat | 0 | 20.0.8-r10 |
| Chainguard | vitess-21 | 0 | 21.0.6-r2 |
| Chainguard | vitess-21-binaries | 0 | 21.0.6-r2 |
| Chainguard | vitess-21-compat | 0 | 21.0.6-r2 |
| Chainguard | vitess-22 | 0 | 22.0.2-r2 |
| Chainguard | vitess-22-binaries | 0 | 22.0.2-r2 |
| Chainguard | vitess-22-compat | 0 | 22.0.2-r2 |
| Chainguard | vitess-23 | 0 | 23.0.0-r2 |
| Chainguard | vitess-23-binaries | 0 | 23.0.0-r2 |
| Chainguard | vitess-23-compat | 0 | 23.0.0-r2 |
| Wolfi | argo-workflow-cli-3.7 | 0 | 3.7.4-r1 |
| Wolfi | argo-workflow-controller-3.7 | 0 | 3.7.4-r1 |
| Wolfi | argo-workflow-controller-3.7-compat | 0 | 3.7.4-r1 |
| Wolfi | argo-workflow-executor-3.7 | 0 | 3.7.4-r1 |
| Wolfi | argo-workflow-executor-3.7-compat | 0 | 3.7.4-r1 |
| Wolfi | argo-workflows-3.7 | 0 | 3.7.4-r1 |
| Wolfi | argo-workflows-known-hosts-3.7 | 0 | 3.7.4-r1 |
| Wolfi | argo-workflows-ui-3.7 | 0 | 3.7.4-r1 |
| Wolfi | code-server | 0 | 4.106.2-r0 |
| Wolfi | code-server-compat | 0 | 4.106.2-r0 |
| Wolfi | eslint | 0 | 9.39.1-r1 |
| Wolfi | jitsucom-jitsu | 0 | 2.11.0-r7 |
| Wolfi | jitsucom-jitsu-console | 0 | 2.11.0-r7 |
| Wolfi | jitsucom-jitsu-rotor | 0 | 2.11.0-r7 |
| Wolfi | kubeflow-centraldashboard | 0 | 1.10.0-r10 |
| Wolfi | kubeflow-pipelines | 0 | 2.14.4-r1 |
| Wolfi | kubeflow-pipelines-apiserver | 0 | 2.14.4-r1 |
| Wolfi | kubeflow-pipelines-cache-deployer | 0 | 2.14.4-r1 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 0 | 2.14.4-r1 |
| Wolfi | kubeflow-pipelines-cache_server | 0 | 2.14.4-r1 |
| Wolfi | kubeflow-pipelines-frontend | 0 | 2.14.4-r1 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 0 | 2.14.4-r1 |
| Wolfi | kubeflow-pipelines-metadata-writer | 0 | 2.14.4-r1 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 0 | 2.14.4-r1 |
| Wolfi | kubeflow-pipelines-persistence_agent | 0 | 2.14.4-r1 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 0 | 2.14.4-r1 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 0 | 2.14.4-r1 |
| Wolfi | langfuse | 0 | 3.134.0-r0 |
| Wolfi | langfuse-compat | 0 | 3.134.0-r0 |
| Wolfi | langfuse-worker | 0 | 3.134.0-r0 |
| Wolfi | lerna | 0 | 9.0.1-r1 |
| Wolfi | opensearch-dashboards-2 | 0 | 2.19.4-r1 |
| Wolfi | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 2.19.4-r1 |
| Wolfi | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r1 |
| Wolfi | opensearch-dashboards-2-compat | 0 | 2.19.4-r1 |
| Wolfi | opensearch-dashboards-2-config | 0 | 2.19.4-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-maps | 0 | 2.19.4-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-notifications | 0 | 2.19.4-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-observability | 0 | 2.19.4-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-query-workbench | 0 | 2.19.4-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.4-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-search-relevance | 0 | 2.19.4-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-visualizations | 0 | 2.19.4-r1 |
| Wolfi | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 2.19.4-r1 |
Related vulnerabilities
- CVE-2025-64718 js-yaml is a JavaScript YAML parser and dumper. Same vulnerability
- CVE-2026-53550 js-yaml is a JavaScript YAML parser and dumper. Also affects js-yaml
- GHSA-h67p-54hq-rp68 JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases Also affects js-yaml
- GHSA-2pr6-76vf-7546 Denial of Service in js-yaml Also affects js-yaml
- GHSA-8j8c-7jfh-h6hx Code Injection in js-yaml Also affects js-yaml
- CVE-2013-4660 The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the… Also affects js-yaml
- GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names Also affects arangodb-3.11
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects arangodb-3.11