What’s Vulnerable › Vulnerabilities

CVE-2013-4660

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 17.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2013-06-28 · updated 2026-06-16
• Weakness: CWE-20

Description

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.

Affected products

• nodeca js-yaml: through 2.0.4; 0.2.0, 0.2.1, 0.2.2, 0.3.0, 0.3.1, 0.3.2 (+13)

References

• http://portal.nodesecurity.io/advisories/js-yaml
• https://nealpoole.com/blog/2013/06/code-execution-via-yaml-in-js-yaml-nodejs-module/
• http://portal.nodesecurity.io/advisories/js-yaml
• https://nealpoole.com/blog/2013/06/code-execution-via-yaml-in-js-yaml-nodejs-module/

Get alerted when CVE-2013-4660 or the next vulnerability affects your stack