Description
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.
Remediation
References
http://portal.nodesecurity.io/advisories/js-yaml
https://nealpoole.com/blog/2013/06/code-execution-via-yaml-in-js-yaml-nodejs-module/
Related Vulnerabilities
CVE-2019-1003034 Vulnerability in maven package org.jenkins-ci.plugins:job-dsl
CVE-2022-1466 Vulnerability in maven package org.keycloak:keycloak-core
CVE-2020-13444 Vulnerability in maven package com.liferay:com.liferay.dynamic.data.mapping.service
CVE-2016-1000031 Vulnerability in maven package commons-fileupload:commons-fileupload
CVE-2021-26118 Vulnerability in maven package org.apache.activemq:artemis-openwire-protocol