medium6.8Public exploit code
CVE-2013-4660
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute ar…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Nodejs - 'js-yaml load()' Code Exec (Metasploit)2013-09-30 · local · multiple · Verified
Impact
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nodeca | Js-Yaml | through 2.0.4 Versions 0.2.0, 0.2.1, 0.2.2, 0.3.0, 0.3.1 |