PT-2025-46851 · Js Yaml+1 · Js-Yaml+1

Published 2025-11-13 · Updated 2026-06-04 · CVE-2025-64718

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions js-yaml versions prior to 4.1.1

Description js-yaml is a JavaScript YAML parser and dumper. A flaw exists where an attacker can alter the prototype of a parsed YAML document, leading to prototype pollution. This impacts users parsing untrusted YAML documents. The issue is addressed in js-yaml version 4.1.1. Prototype pollution occurs when an attacker manipulates the proto property to modify the prototype of an object, potentially affecting all objects that inherit from it.

Recommendations Update to js-yaml version 4.1.1 or later. Use node --disable-proto=delete when running with Node.js. Utilize Deno, as pollution protection is enabled by default.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-64718

GHSA-MH29-5H37-FV8M

OPENSUSE-SU-2026:10036-1

OPENSUSE-SU-2026:20117-1

OPENSUSE-SU-2026:20251-1

SUSE-SU-2026:20170-1

SUSE-SU-2026:20182-1

SUSE-SU-2026:20540-1

SUSE-SU-2026:20580-1

Affected Products

Debian

Js-Yaml

References · 38

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64718.json · Exploit
• https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266 · Patch
• https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m · Vendor Advisory
• https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:20540-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-64718 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-64718 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-64718 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:20182-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20251-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64718 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20117-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10036-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-64718 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mh29-5h37-fv8m · Vendor Advisory