Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix possible code execution in (already unsafe) load() #480

merged 1 commit into from Apr 5, 2019


None yet
3 participants
Copy link

commented Apr 5, 2019

Object with executable toString() property when used as a map key will execute that function.

This happens only for load(), which should not be used with untrusted data anyway. safeLoad() is not affected because it can't parse functions.


$ cat test.yaml
{ toString: !<,2002:js/function> 'function (){return}' } : 1

$ ./bin/js-yaml.js ./test.yaml 
  "1553107949161": 1

After this PR it would return [object Object] as if toString wasn't there.

Dates are not affected, and if you for whatever reason are using custom types as keys (which is not supported very well), you can change internal class with Symbol.toStringTag bypassing added validation check.

Fix possible code execution in (already unsafe) load()
... when object with executable toString() property is used as a map key

@rlidwka rlidwka marked this pull request as ready for review Apr 5, 2019

@puzrin puzrin merged commit b2f9e88 into master Apr 5, 2019

3 checks passed

continuous-integration/travis-ci/pr The Travis CI build passed
continuous-integration/travis-ci/push The Travis CI build passed
security/snyk - package.json (puzrin) No manifest changes detected

This comment has been minimized.

Copy link

commented Apr 8, 2019

Is anyone getting a CVE for this issue? If not, I can do it.

HDVinnie added a commit to HDInnovations/UNIT3D that referenced this pull request Apr 16, 2019

This was referenced May 19, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.