PT-2020-19755 · Js Yaml+1 · Js-Yaml+1

Published 2020-10-02 · Updated 2021-05-10 · CVE-2020-7738

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions shiba versions (affected versions not specified)

Description The issue concerns Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement, safeLoad().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-7738

GHSA-JVF4-G24P-2QGW

SNYK-JS-SHIBA-596466

Affected Products

Js-Yaml

Shiba

References · 5

• https://osv.dev/vulnerability/GHSA-jvf4-g24p-2qgw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7738 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7738 · Vendor Advisory
• https://npmjs.com/package/shiba · Note
• https://snyk.io/vuln/SNYK-JS-SHIBA-596466 · Note