CVE-2025-64718
📋 TL;DR
This CVE describes a prototype pollution vulnerability in js-yaml, a JavaScript YAML parser. Attackers can modify object prototypes by injecting malicious YAML content, potentially leading to denial of service, remote code execution, or privilege escalation. All users parsing untrusted YAML documents with vulnerable versions are affected.
💻 Affected Systems
- js-yaml
📦 What is this software?
Js Yaml by Nodeca
Js Yaml by Nodeca
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or persistent backdoor installation.
Likely Case
Denial of service, application crashes, or limited privilege escalation within the application context.
If Mitigated
No impact if proper input validation and patched versions are used.
🎯 Exploit Status
Exploitation requires the ability to supply malicious YAML content to the parser. Public proof-of-concept exists in advisory references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.1 or 3.14.2
Vendor Advisory: https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m
Restart Required: Yes
Instructions:
1. Update js-yaml dependency to version 4.1.1 or 3.14.2. 2. Run 'npm update js-yaml' or 'yarn upgrade js-yaml'. 3. Restart the application/service. 4. Test YAML parsing functionality.
🔧 Temporary Workarounds
Node.js prototype protection
linuxDisable prototype pollution via Node.js runtime flag
node --disable-proto=delete your-app.js
Input validation
allValidate and sanitize all YAML input before parsing
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all YAML inputs
- Use Deno runtime instead of Node.js (has built-in protection)
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list js-yaml' to see installed versionCheck Version:
npm list js-yaml | grep js-yamlVerify Fix Applied:
Confirm version is 4.1.1 or higher (for v4) or 3.14.2 or higher (for v3)📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes
- Unusual YAML parsing errors
- Memory exhaustion warnings
Network Indicators:
- Unusual YAML payloads in requests
- Large or malformed YAML uploads
SIEM Query:
source="application_logs" AND ("js-yaml" OR "YAML parser") AND (error OR crash OR exception)🔗 References
- https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879
- https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266
- https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m
- https://github.com/advisories/GHSA-mh29-5h37-fv8m
