5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-64718

CVE-2025-64718: js-yaml has prototype pollution in merge (<<)

js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-64718

CVE-2025-64718:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
js-yaml	npm	< 4.1.1	4.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a prototype pollution issue within the js-yaml library, affecting versions up to 4.1.0. The root cause lies in the unsafe handling of keys named __proto__ during the parsing of YAML documents. When a YAML file containing such a key is parsed, the library would directly assign properties to a JavaScript object, allowing an attacker to modify the prototype of all objects in the application.

The patch addresses this by introducing a new setProperty function in lib/loader.js. This function specifically checks for the __proto__ key and, if found, uses Object.defineProperty to set the value. This method of property assignment prevents prototype pollution. For all other keys, it uses a standard, faster assignment.

Two functions were identified as vulnerable because they were modified to use this new setProperty function:

storeMappingPair: This function is responsible for creating key-value pairs from the YAML input. The original code performed a direct assignment, _result[keyNode] = valueNode, which was the source of the vulnerability for standard mappings.
mergeMappings: This function implements the YAML merge (<<) feature. It was also vulnerable due to a direct assignment, destination[key] = source[key], when merging mappings.

By patching these two functions, the library now safely handles __proto__ keys, preventing the prototype pollution vulnerability. During an exploit, these two functions would be present in the call stack as they process the malicious YAML input.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.