Prototype Pollution Vulnerability in js-yaml by Nodeca

CVE-2025-64718

What is CVE-2025-64718?

The js-yaml library, a popular JavaScript YAML parser and dumper, contains a vulnerability that allows attackers to manipulate the prototype of parsed YAML documents through a technique known as prototype pollution. This affects all users handling untrusted YAML inputs. The flaw has been addressed in js-yaml version 4.1.1, and users are encouraged to upgrade. Additional protection measures can be implemented by running Node.js with the '--disable-proto=delete' option or by using Deno, which offers built-in protection against prototype pollution.

References