CVE-2013-4660: nodeca js-yaml Improper Input Validation
Vulnerability summary
CVE-2013-4660 is a medium (CVSS 6.8) Improper Input Validation vulnerability in nodeca js-yaml. EPSS estimates a 17.32% chance of exploitation in the next 30 days, higher than 97% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 28-06-2013PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
17.32%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 17.32% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (nealpoole.com)
Maturity: unknown
Nodejs - 'js-yaml load()' Code Exec (Metasploit)
Maturity: weaponized
Nodejs js-yaml load() Code Execution
exploit/multi/fileformat/nodejs_js_yaml_load_code_exec
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Nodeca1 product
- js-yaml≤ 2.0.4 | 0.2.0 | 0.2.1 | 0.2.2 | 0.3.0 | 0.3.1 | 0.3.2 | 0.3.3 | 0.3.4 | 0.3.5 | 0.3.6 | 0.3.7 | 1.0.0 | 1.0.1 | 1.0.2 | 1.0.3 | 2.0.0 | 2.0.1 | 2.0.2 | 2.0.3
Npm1 product
- js-yaml< 2.0.5
2 vendors · 2 products
References
6 links- nealpoole.com/blog/2013/06/code-execution-via-yaml-in-js-yaml-nodejs-module/X Refsource MISCExploitVendor Advisory
