Description
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.
Remediation
References
http://portal.nodesecurity.io/advisories/js-yaml
https://nealpoole.com/blog/2013/06/code-execution-via-yaml-in-js-yaml-nodejs-module/
Related Vulnerabilities
CVE-2022-40705 Vulnerability in maven package soap:soap
CVE-2022-46682 Vulnerability in maven package org.jenkins-ci.plugins:plot
CVE-2023-39522 Vulnerability in npm package @goauthentik/api
CVE-2015-3250 Vulnerability in maven package org.apache.directory.api:api-ldap-model
CVE-2016-4431 Vulnerability in maven package org.apache.struts:struts2-core