WS-2019-0063 | Mend Vulnerability Database

Vulnerability DatabaseWS-2019-0063

WS-2019-0063

Published:May 19, 2026

Updated:May 19, 2026

Js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file.

Affected Packages

js-yaml (CDN_JS):

Affected version(s) >=3.0.2 <3.13.1

Fix Suggestion:

Update to version 3.13.1

jsdom (CONDA):

Affected version(s) =11.0.0 <11.11.0

Fix Suggestion:

Update to version 11.11.0

genenotebook (CONDA):

Affected version(s) >=0.1.1 <0.1.16

Fix Suggestion:

Update to version 0.1.16

svg2png (CONDA):

Affected version(s) =4.1.1

Fix Suggestion:

Update to version no_fix

grunt (CONDA):

Affected version(s) =1.0.4

Fix Suggestion:

Update to version no_fix

js-yaml (NPM):

Affected version(s) >=0.2.0 <3.13.1

Fix Suggestion:

Update to version 3.13.1

ncapsulate.grunt (NUGET):

Affected version(s) >=0.4.4 <=0.4.5.2

Fix Suggestion:

Update to version no_fix

karmanodemodules (NUGET):

Affected version(s) >=1.0.0 <=1.0.1

Fix Suggestion:

Update to version no_fix

dianoga (NUGET):

Affected version(s) >=3.0.0-beta01 <4.0.0

Fix Suggestion:

Update to version 4.0.0

ng-grid (NUGET):

Affected version(s) >=2.0.3 <2.0.4

Fix Suggestion:

Update to version 2.0.4

dianoga (NUGET):

Affected version(s) =3.0.0-RC01 <3.0.0-RC02

Fix Suggestion:

Update to version 3.0.0-RC02

entityframework.lookuptables (NUGET):

Affected version(s) >=1.1.12.119 <1.1.14.119

Fix Suggestion:

Update to version 1.1.14.119

sheelersoft.angulartemplate (NUGET):

Affected version(s) >=0.0.1 <=0.0.2

Fix Suggestion:

Update to version no_fix

angularjstypescriptbase (NUGET):

Affected version(s) =1.0.0

Fix Suggestion:

Update to version no_fix

tslint (NUGET):

Affected version(s) >=5.9.1 <5.17.0

Fix Suggestion:

Update to version 5.17.0

nougatui (NUGET):

Affected version(s) =1.0.0 <1.0.1

Fix Suggestion:

Update to version 1.0.1

indianadavy.vuejswebapitemplate.csharp (NUGET):

Affected version(s) =1.0.0 <1.0.1

Fix Suggestion:

Update to version 1.0.1

dotnetng.template (NUGET):

Affected version(s) >=1.0.0.1 <1.0.0.4

Fix Suggestion:

Update to version 1.0.0.4

raml.parser (NUGET):

Affected version(s) >=1.0.0 <1.0.7

Fix Suggestion:

Update to version 1.0.7

ncapsulate.grunt.shadow (NUGET):

Affected version(s) =0.4.5.3

Fix Suggestion:

Update to version no_fix

pwptemplatecms (NUGET):

Affected version(s) >=0.0.1 <=0.0.2

Fix Suggestion:

Update to version no_fix

pwptemplatepusintek (NUGET):

Affected version(s) =0.0.1

Fix Suggestion:

Update to version no_fix

fable.template.elmish.react (NUGET):

Affected version(s) =0.1.5 <0.1.6

Fix Suggestion:

Update to version 0.1.6

astest (NUGET):

Affected version(s) =1.0.0

Fix Suggestion:

Update to version no_fix

ncapsulate.bower (NUGET):

Affected version(s) >=1.3.2 <=1.3.12.1

Fix Suggestion:

Update to version no_fix

romano.vue (NUGET):

Affected version(s) =1.0.0 <1.0.1

Fix Suggestion:

Update to version 1.0.1

yeoman (NUGET):

Affected version(s) =1.1.2

Fix Suggestion:

Update to version no_fix

vuetemplate (NUGET):

Affected version(s) =0.1.0

Fix Suggestion:

Update to version no_fix

midiator.webclient (NUGET):

Affected version(s) >=1.0.98 <1.0.105

Fix Suggestion:

Update to version 1.0.105

bower (NUGET):

Affected version(s) >=1.2.7 <=1.3.11

Fix Suggestion:

Update to version no_fix

yarnpkg.yarn (NUGET):

Affected version(s) >=0.19.1.1 <0.26.1

Fix Suggestion:

Update to version 0.26.1

antdata.orm (NUGET):

Affected version(s) =1.2.8 <1.2.9

Fix Suggestion:

Update to version 1.2.9

nordron.angulartemplate (NUGET):

Affected version(s) =0.1.5 <0.1.6

Fix Suggestion:

Update to version 0.1.6

sheeler.angulartemplate (NUGET):

Affected version(s) =0.0.1

Fix Suggestion:

Update to version no_fix

scancode/portal-module (PHP):

Affected version(s) =v1.0.0 <v1.0.1

Fix Suggestion:

Update to version v1.0.1

chrisbraybrooke/laravel-ecommerce (PHP):

Affected version(s) =dev-dev <dev-form-field-key

Fix Suggestion:

Update to version dev-form-field-key

humanmade/coding-standards (PHP):

Affected version(s) >=v0.4.0 <v0.4.2

Fix Suggestion:

Update to version v0.4.2

kayrules/solatjakim-api-site (PHP):

Affected version(s) =dev-master <dev-version-1.0

Fix Suggestion:

Update to version dev-version-1.0

limefamily/yii2-limetheme (PHP):

Affected version(s) >=1.0.0 <1.0.12

Fix Suggestion:

Update to version 1.0.12

zymawy/ironside-core (PHP):

Affected version(s) =dev-master <dev-utils

Fix Suggestion:

Update to version dev-utils

los/losui (PHP):

Affected version(s) =1.0.14 <1.0.15

Fix Suggestion:

Update to version 1.0.15

dreamfactory/df-api-docs-ui (PHP):

Affected version(s) >=1.0.0 <1.1.0

Fix Suggestion:

Update to version 1.1.0

tikiwiki/diagram (PHP):

Affected version(s) =v6.5.6 <v6.5.7

Fix Suggestion:

Update to version v6.5.7

oxid-esales/wave-theme (PHP):

Affected version(s) =dev-motorrad <dev-oxscript-google-analytics

Fix Suggestion:

Update to version dev-oxscript-google-analytics

hillelcoren/invoice-ninja (PHP):

Affected version(s) >=v1.6.0 <dev-dependabot/npm_and_yarn/follow-redirects-1.15.4

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/follow-redirects-1.15.4

ilhanet/erpnet-widget-resource (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

oburatongoi/productivity (PHP):

Affected version(s) >=0.1.0 <=0.4.45

Fix Suggestion:

Update to version no_fix

chrisbraybrooke/laravel-ecommerce (PHP):

Affected version(s) >=0.0.4 <0.0.17

Fix Suggestion:

Update to version 0.0.17

opichon/autotabs (PHP):

Affected version(s) >=2.0.5 <2.0.11

Fix Suggestion:

Update to version 2.0.11

archambaultalex/image-field (PHP):

Affected version(s) =dev-main

Fix Suggestion:

Update to version no_fix

xenomedia/xeno-base (PHP):

Affected version(s) >=0.0.3 <=0.0.4

Fix Suggestion:

Update to version no_fix

tyler-zou/phpgame (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

frankyframework/franky2 (PHP):

Affected version(s) =dev-main

Fix Suggestion:

Update to version no_fix

redkite-labs/redkite-cms (PHP):

Affected version(s) =dev-master <1.1.x-dev

Fix Suggestion:

Update to version 1.1.x-dev

trezebits/trezevel-gallery (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

humanmade/workflows (PHP):

Affected version(s) =dev-gh-actions <dev-master

Fix Suggestion:

Update to version dev-master

awema-pl/module-psmoduler (PHP):

Affected version(s) >=v1.0.1 <v1.0.4

Fix Suggestion:

Update to version v1.0.4

narirock/marrs-catalog (PHP):

Affected version(s) >=dev-dev <=1

Fix Suggestion:

Update to version no_fix

timoetting/kirby-builder (PHP):

Affected version(s) =2.0.3 <v2.0.3

Fix Suggestion:

Update to version v2.0.3

ymcatwincities/openy-cibox-vm (PHP):

Affected version(s) =dev-master <dev-snyk-fix-d3e304fdb18d8e743e047d064f2eeebe

Fix Suggestion:

Update to version dev-snyk-fix-d3e304fdb18d8e743e047d064f2eeebe

seidemann-web/wave-theme (PHP):

Affected version(s) =dev-motorrad <dev-omage-theme

Fix Suggestion:

Update to version dev-omage-theme

triawarman/yii2-richfilemanager (PHP):

Affected version(s) >=dev-bckp-develop <v0.1

Fix Suggestion:

Update to version v0.1

humanmade/workflows (PHP):

Affected version(s) =0.4.7 <0.4.8-rc.1

Fix Suggestion:

Update to version 0.4.8-rc.1

i-saad-salman/statamic-analytics (PHP):

Affected version(s) =dev-main

Fix Suggestion:

Update to version no_fix

seidemann-web/wave-theme (PHP):

Affected version(s) =dev-feature/WT-21

Fix Suggestion:

Update to version no_fix

timoetting/kirby-builder (PHP):

Affected version(s) =2.0.0 <v2.0.0

Fix Suggestion:

Update to version v2.0.0

kraenkvisuell/nova-cms-media (PHP):

Affected version(s) >=v1.0.4 <v1.2.2

Fix Suggestion:

Update to version v1.2.2

humanmade/coding-standards (PHP):

Affected version(s) >=0.1.0 <dev-dependabot/npm_and_yarn/json-schema-0.4.0

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/json-schema-0.4.0

seidemann-web/wave-theme (PHP):

Affected version(s) >=dev-WT-27/sticky-header <dev-WT-36/Sticky-Header-Fixes

Fix Suggestion:

Update to version dev-WT-36/Sticky-Header-Fixes

adamstyperek/base.symfony.crud (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

chrisbraybrooke/laravel-ecommerce (PHP):

Affected version(s) =0.0.1 <0.0.2

Fix Suggestion:

Update to version 0.0.2

efecanaltay/hello-world (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

adrexia/silverstripe-pure (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

gmo/common (PHP):

Affected version(s) >=v1.0.0 <v1.29.0

Fix Suggestion:

Update to version v1.29.0

kraenkvisuell/nova-cms-media (PHP):

Affected version(s) >=v2.0.0 <=v2.1.3

Fix Suggestion:

Update to version no_fix

ymcatwincities/openy-cibox-vm (PHP):

Affected version(s) >=dev-snyk-fix-19013f5e293df9c71f68bf9631fba9f2 <dev-snyk-fix-45a393004964497d68443389076d755a

Fix Suggestion:

Update to version dev-snyk-fix-45a393004964497d68443389076d755a

timoetting/kirby-builder (PHP):

Affected version(s) =2.0.2 <v2.0.2

Fix Suggestion:

Update to version v2.0.2

adrexia/flowchart (PHP):

Affected version(s) >=dev-false-fix-new-states <=1.0.x-dev

Fix Suggestion:

Update to version no_fix

virhi/admin-bundle (PHP):

Affected version(s) >=v0.1.1 <0.2.0

Fix Suggestion:

Update to version 0.2.0

gudwin/faid (PHP):

Affected version(s) =0.7.11 <0.8.0

Fix Suggestion:

Update to version 0.8.0

gheb/nn (PHP):

Affected version(s) =dev-installed-example <dev-master

Fix Suggestion:

Update to version dev-master

oburatongoi/productivity (PHP):

Affected version(s) >=0.0.9 <0.0.13

Fix Suggestion:

Update to version 0.0.13

ymcatwincities/openy-cibox-vm (PHP):

Affected version(s) =dev-snyk-upgrade-c10ea3c8666b5b22429d3e747ff879aa <dev-snyk-fix-5c35a6fcce9a99be5f2075759c8a3425

Fix Suggestion:

Update to version dev-snyk-fix-5c35a6fcce9a99be5f2075759c8a3425

miljoen/nova-autofill (PHP):

Affected version(s) =dev-master <v1.0.0

Fix Suggestion:

Update to version v1.0.0

chrisbraybrooke/laravel-ecommerce (PHP):

Affected version(s) >=v0.0.17 <0.0.56

Fix Suggestion:

Update to version 0.0.56

seidemann-web/wave-theme (PHP):

Affected version(s) =dev-bugfix/variants-fix <dev-fixUpLanguageConstants

Fix Suggestion:

Update to version dev-fixUpLanguageConstants

jadu/pulsar (PHP):

Affected version(s) >=1.0.13 <1.0.16

Fix Suggestion:

Update to version 1.0.16

bccampus/rest-routes (PHP):

Affected version(s) =dev-master <1.0.3

Fix Suggestion:

Update to version 1.0.3

scancode/portal-module (PHP):

Affected version(s) >=v0.0.1 <v0.0.22

Fix Suggestion:

Update to version v0.0.22

kraenkvisuell/nova-cms-media (PHP):

Affected version(s) >=dev-main <v1.0.3

Fix Suggestion:

Update to version v1.0.3

kzima/slimbone (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

miljoen/nova-autofill (PHP):

Affected version(s) >=v1.2 <=v1.4

Fix Suggestion:

Update to version no_fix

computerundsound/curserver (PHP):

Affected version(s) =dev-master <2.2.0

Fix Suggestion:

Update to version 2.2.0

hillelcoren/invoice-ninja (PHP):

Affected version(s) >=v1.1.1 <dev-dependabot/npm_and_yarn/axios-1.6.0

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/axios-1.6.0

lukesnowden/application-base (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

sombrerodepaja/franky-skeleton-application (PHP):

Affected version(s) >=dev-dependabot/npm_and_yarn/engine.io-and-browser-sync-6.2.1 <=dev-dependabot/npm_and_yarn/qs-and-grunt-contrib-watch-6.4.1

Fix Suggestion:

Update to version no_fix

redkite-labs/redkite-cms (PHP):

Affected version(s) =dev-2.0-alpha <v2.0.0-alpha

Fix Suggestion:

Update to version v2.0.0-alpha

oburatongoi/productivity (PHP):

Affected version(s) =dev-master <0.0.1

Fix Suggestion:

Update to version 0.0.1

xenomedia/xeno-base (PHP):

Affected version(s) =dev-master <0.0.1

Fix Suggestion:

Update to version 0.0.1

computerundsound/curserver (PHP):

Affected version(s) >=3.2.0.x-dev <=4.0.1

Fix Suggestion:

Update to version no_fix

ears (RUST):

Affected version(s) =0.3.3 <0.3.4

Fix Suggestion:

Update to version 0.3.4

Related Resources (2)

https://github.com/nodeca/js-yaml/commit/b2f9e882397660da37c5c5bb92e8ccc7bb9eb668

https://github.com/nodeca/js-yaml/pull/480

Do you need more information?

CVSS v4

Base Score:

9.2

Attack Vector

NETWORK

Attack Complexity

HIGH

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

NONE

Vulnerable System Confidentiality

HIGH

Vulnerable System Integrity

HIGH

Vulnerable System Availability

HIGH

Subsequent System Confidentiality

NONE

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH