What is CVE-2013-4660?

CVE-2013-4660 is a vulnerability in Nodeca Js-yaml, classified under Improper Input Validation. Published 2013-06-28.

Is CVE-2013-4660 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Improper input validation in Nodeca Js-yaml

CVE-2013-4660

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.645 (98.5th percentile) — read the EPSS interpretation.

Affected products

Nodeca Js-yaml — versions 0.2.0, 0.2.1, 0.2.2
N/a — versions n/a

Weakness classification (CWE)

CWE-20 — Improper Input Validation

Public proof-of-concept exploits

References

cve@mitre.org (Exploit, x_refsource_MISC, Vendor Advisory)
cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2013-4660?: CVE-2013-4660 is a vulnerability in Nodeca Js-yaml, classified under Improper Input Validation. Published 2013-06-28.
Is CVE-2013-4660 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.