CVE-2013-4660
nodeca js-yaml: no CVSS score yet. EPSS 17% chance of exploitation in the next 30 days. Fixed in js-yaml 2.0.5.
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.
- EPSS
- 17% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- nodeca:js-yaml
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xxvw-45rp-3mj2 | npm | js-yaml | <2.0.5 | 2.0.5 |