CVE-2013-4660

medium

Published 2013-06-28 · Modified 2023-11-08

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

7.8

Description

Deserialization Code Execution in js-yaml

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-28655 local multiple verified

Metasploit · 2013-09-30

Nodejs - 'js-yaml load()' Code Exec (Metasploit)

Source code queued for fetch — refresh in a moment.

Metasploit modules

exploit_multi/fileformat/nodejs_js_yaml_load_code_exec rank 600

Nodejs js-yaml load() Code Execution

Source fetch failed: fetch_error — view the original via the link above.

Package impact

Ecosystem	Package	Vulnerable	Fixed
npm	js-yaml	`<2.0.5`	`2.0.5`

Application impact

Vendor	Product	Versions	Fixed
nodeca	js-yaml	`{"endIncluding":"2.0.4"}`
nodeca	js-yaml	`0.2.0`
nodeca	js-yaml	`0.2.1`
nodeca	js-yaml	`0.2.2`
nodeca	js-yaml	`0.3.0`
nodeca	js-yaml	`0.3.1`
nodeca	js-yaml	`0.3.2`
nodeca	js-yaml	`0.3.3`
nodeca	js-yaml	`0.3.4`
nodeca	js-yaml	`0.3.5`
nodeca	js-yaml	`0.3.6`
nodeca	js-yaml	`0.3.7`
nodeca	js-yaml	`1.0.0`
nodeca	js-yaml	`1.0.1`
nodeca	js-yaml	`1.0.2`
nodeca	js-yaml	`1.0.3`
nodeca	js-yaml	`2.0.0`
nodeca	js-yaml	`2.0.1`
nodeca	js-yaml	`2.0.2`
nodeca	js-yaml	`2.0.3`

References

CWEs

CWE-20

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.