js-yaml Under Attack: Understanding and Mitigating CVE-2025-64718

Overview

CVE-2025-64718 describes a prototype pollution vulnerability found in js-yaml, a popular JavaScript YAML parser and dumper. Specifically, versions 4.1.0 and below are susceptible to attacks where malicious YAML documents can modify the prototype of JavaScript objects during parsing. This can lead to various security implications, especially when parsing untrusted YAML data.

Technical Details

The vulnerability arises from the improper handling of the __proto__ property within YAML documents. An attacker can craft a YAML document containing __proto__ keys that, when parsed by a vulnerable js-yaml version, will modify the prototype of JavaScript objects. This modification can inject malicious properties and methods into all objects inheriting from that prototype, potentially leading to code execution or denial-of-service attacks.

Here’s a simplified example of a malicious YAML payload:

__proto__:
  polluted: true

        

When parsed, this YAML will add a “polluted” property to the Object prototype. Any subsequent object created in the application will inherit this “polluted” property.

CVSS Analysis

This vulnerability has been assigned a CVSS score of 5.3 (MEDIUM). While not critical, the potential impact of prototype pollution should not be underestimated. A successful exploit could lead to code execution, information disclosure, or denial of service. The CVSS vector reflects the potential for network-based exploitation and the scope of the impact.

Possible Impact

The impact of CVE-2025-64718 can vary depending on how js-yaml is used within an application. Potential consequences include:

• Code Execution: An attacker could potentially inject malicious code into the application by modifying the prototype of built-in JavaScript objects.
• Denial of Service (DoS): By polluting prototypes with resource-intensive properties, an attacker could cause the application to consume excessive resources, leading to a denial of service.
• Information Disclosure: In some cases, an attacker could manipulate prototypes to gain access to sensitive information.

Mitigation or Patch Steps

The vulnerability is patched in js-yaml version 4.1.1. It is highly recommended to update to this version or later.

If upgrading is not immediately possible, consider the following mitigations:

• Server-Side Protection (Node.js): Use the node --disable-proto=delete flag when running your Node.js application. This disables the ability to modify the __proto__ property.
• Deno Environment: If you are using Deno, pollution protection is enabled by default, offering inherent protection against this vulnerability.
• Input Validation: Carefully validate and sanitize any YAML data before parsing it with js-yaml. While this is not a foolproof solution, it can help reduce the risk of exploitation.

References

• CVE ID: CVE-2025-64718
• GitHub Commit: js-yaml commit 383665ff4248ec2192d1274e934462bb30426879
• GitHub Security Advisory: GHSA-mh29-5h37-fv8m