AIKIDO-2025-10809

js-yaml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2025-64718 Published Nov 14, 2025

Medium Risk

This Affects:

js-yaml

3.0.0 - 3.14.1

Fixed in 3.14.2

4.0.0 - 4.1.0

Fixed in 4.1.1

Are you affected? Scan for Free

TL;DR

Affected versions of this package are vulnerable to Prototype Pollution, where the code insufficiently validates properties during merging by checking only own properties with _hasOwnProperty, allowing attackers to craft malicious YAML input that injects keys like __proto__ or constructor into the object prototype. This vulnerability can lead to remote code execution, denial of service, or other security breaches when the polluted objects are handled in the application.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

js-yaml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 3.0.0 - 3.14.1 and 4.0.0 - 4.1.0.