The js-yaml package, before version 3.13.1, is vulnerable to code execution when loading malicious yaml. When an object with an executable toString() property used as a map key, it will execute that function. This happens only for load(), which should not be used with untrusted data anyway. safeLoad() is not affected because it can't parse functions. Upstream Fix: https://github.com/nodeca/js-yaml/pull/480 Reference: https://snyk.io/vuln/SNYK-JS-JSYAML-174129
Created nodejs-js-yaml tracking bugs for this issue: Affects: epel-all [bug 1719065] Affects: fedora-all [bug 1719064] Created python-XStatic-JS-Yaml tracking bugs for this issue: Affects: openstack-rdo [bug 1719066]
External Reference: https://www.npmjs.com/advisories/813
This vulnerability is out of security support scope for the following product: * Red Hat Mobile Application Platform Please refer to https://access.redhat.com/support/policy/updates/rhmap for more details
This does not seem to be a vulnerability in the js-yaml package but rather it can result in a vulnerability if the load() method is used on untrusted input rather than safeLoad(). Any CVE assignments should be made to codebases using this package in an unsafe way, rather than the js-yaml package itself.