0Xbughunter

**Name of the Vulnerable Software and Affected Versions** js-yaml versions prior to 4.2.0 **Description** A crafted YAML document can trigger algorithmic CPU exhaustion during merge-key processing (`<<`) by repeating the same alias multiple times in a merge sequence. This results in quadratic parse-time behavior relative to the input size, which can block a Node.js worker or event loop for several seconds even with a small payload (tens of KB), leading to a denial of service. The issue resides in the merge handling within `lib/loader.js`, specifically inside the `storeMappingPair()` function and the `mergeMappings()` function. When a merge value is a sequence, the parser processes each element without deduplication; if multiple entries refer to the same anchored object, the parser redundantly re-processes all keys for each reference. **Recommendations** Update to version 4.2.0. As a temporary workaround, restrict the processing of untrusted YAML documents that utilize merge-key sequences until the update is applied.

**Name of the Vulnerable Software and Affected Versions** html-to-csv versions all **Description** The issue arises when a formula is embedded in an HTML page and gets accepted without validation, allowing it to be pushed into a CSV file during conversion. This enables a malicious actor to embed or generate malicious links or execute commands via CSV files. **Recommendations** For all versions, consider disabling the conversion of HTML pages with embedded formulas to CSV files until a proper validation mechanism is implemented to prevent malicious links or command execution. Restrict access to the CSV file generation feature to minimize the risk of exploitation. Avoid using the html-to-csv package for converting HTML pages with embedded formulas until the issue is resolved.