CVE-2013-4660

Published: Jun 28, 2013Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.

Affected (20)

Products: Nodeca: Js Yaml

Nodeca

1 product

Js Yaml

Configuration A

20 vulnerable

Vulnerable Software	Affected Versions
Nodeca Js Yaml	Up to 2.0.4
Nodeca Js Yaml	Version 0.2.0
Nodeca Js Yaml	Version 0.2.1
Nodeca Js Yaml	Version 0.2.2
Nodeca Js Yaml	Version 0.3.0
Nodeca Js Yaml	Version 0.3.1
Nodeca Js Yaml	Version 0.3.2
Nodeca Js Yaml	Version 0.3.3
Nodeca Js Yaml	Version 0.3.4
Nodeca Js Yaml	Version 0.3.5
Nodeca Js Yaml	Version 0.3.6
Nodeca Js Yaml	Version 0.3.7
Nodeca Js Yaml	Version 1.0.0
Nodeca Js Yaml	Version 1.0.1
Nodeca Js Yaml	Version 1.0.2
Nodeca Js Yaml	Version 1.0.3
Nodeca Js Yaml	Version 2.0.0
Nodeca Js Yaml	Version 2.0.1
Nodeca Js Yaml	Version 2.0.2
Nodeca Js Yaml	Version 2.0.3