Skip to content
Fencer Vulns
medium 5.3

CVE-2025-64718 json

js-yaml has prototype pollution in merge (<<)

published 2025-11-13 11 mo ago modified 2026-10-07 32 d ago also GHSA-mh29-5h37-fv8m , EUVD-2025-175314

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits
0
none known

Summary

js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).

Patch / fix

  • npm js-yaml 3.14.2, 4.1.1
  • nodeca js-yaml 3.14.2, 4.1.1
  • node-js-yaml Debian 14 4.1.1+dfsg+~4.0.9-1

debian advisories DEBIAN-CVE-2025-64718

  • cockpit-repos SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.7-160000.1.1
  • cockpit-subscriptions SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 12.1-160000.1.1

suse advisories SUSE-SU-2026:20540-1SUSE-SU-2026:20580-1SUSE-SU-2026:20170-1SUSE-SU-2026:20182-1

  • velociraptor openSUSE Tumbleweed 0.7.0.4.git185.a5708584-2.1
  • cockpit-repos openSUSE Leap 16.0 4.7-160000.1.1
  • cockpit-subscriptions openSUSE Leap 16.0 12.1-160000.1.1
  • cockpit-repos openSUSE Tumbleweed 4.6-1.1

opensuse advisories openSUSE-SU-2026:11126-1openSUSE-SU-2026:20251-1openSUSE-SU-2026:20117-1openSUSE-SU-2026:10036-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-64718 updated cvss 5.3

js-yaml: js-yaml prototype pollution in merge

  • Red Hat Cryostat 4 io.cryostat-cryostat, cryostat/cryostat-openshift-console-plugin-rhel9 Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9 Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8, openshift-logging/elasticsearch6-rhel9, openshift-logging/logging-curator5-rhel9, openshift-logging/elasticsearch-proxy-rhel9, openshift-logging/logging-view-plugin-rhel9, openshift-logging/elasticsearch-rhel9-operator, +1 more Red Hat Migration Toolkit for Applications 7 mta/mta-ui-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel9 Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-ui-rhel8
    +18 more products
    Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-console-plugin-rhel9, migration-toolkit-virtualization/mtv-console-plugin-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/console-mce-rhel8, multicluster-engine/console-mce-rhel9 Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-grafana-rhel9 Red Hat Network Observability Operator network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-console-plugin-compat-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8, workload-availability/node-remediation-console-rhel9, workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift API for Data Protection oadp/oadp-mustgather-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-hub-api-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, +2 more Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/pilot-rhel8, openshift-service-mesh/grafana-rhel8, openshift-service-mesh/proxyv2-rhel9, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/ratelimit-rhel8, +4 more Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9, openshift-service-mesh/istio-cni-rhel9, openshift-service-mesh/istio-pilot-rhel9, openshift-service-mesh/kiali-ossmc-rhel9, openshift-service-mesh/istio-proxyv2-rhel9, openshift-service-mesh/istio-ztunnel-rhel9, +7 more Red Hat 3scale API Management Platform 2 3scale-amp20/system, 3scale-amp21/system, 3scale-amp22/system, 3scale-amp24/system, 3scale-amp25/system, 3scale-amp26/system, +3 more Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel9, rhacm2/acm-grafana-rhel9, rhacm2/acm-flightctl-ui-rhel9, rhacm2/acm-flightctl-ocp-ui-rhel9 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-operator-bundle, advanced-cluster-security/rhacs-central-db-rhel8, +2 more Red Hat AMQ Broker 7 org.jolokia-jolokia-parent Red Hat Ansible Automation Platform 2 automation-gateway, automation-controller, automation-platform-ui, automation-eda-controller, ansible-automation-platform-26/gateway-rhel9, ansible-automation-platform-24/lightspeed-rhel8, +2 more Red Hat build of Apache Camel - HawtIO 4 io.hawt-project Red Hat build of Apicurio Registry 2 io.apicurio-apicurio-registry Red Hat build of OptaPlanner 8 org.optaweb.vehiclerouting-optaweb-vehicle-routing
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Ceph Storage 6 grafana Red Hat Ceph Storage 7 grafana Red Hat Ceph Storage 8 grafana Red Hat Ceph Storage 9 grafana
    affected: workaround, no fix available
  • Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9 Red Hat Data Grid 8 org.infinispan-infinispan-console Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Directory Server 11 389-ds-base Red Hat Directory Server 12 389-ds-base Red Hat Directory Server 13 389-ds-base
    +6 more products
    Red Hat Discovery 2 discovery/discovery-ui-rhel9 Red Hat Edge Manager preview rhem/flightctl-ui-rhel9, rhem/flightctl-api-rhel9, rhem/flightctl-ui-ocp-rhel9, rhem/flightctl-worker-rhel9, rhacm2/acm-flightctl-ui-rhel9, rhem/flightctl-db-setup-rhel9, +7 more Red Hat Enterprise Linux 8 pcs, grafana, mozjs60, pcs-snmp, grafana-loki, grafana-mssql, +11 more Red Hat Enterprise Linux 9 gjs, pcs, polkit, grafana, pcs-snmp, polkit-libs, +1 more Red Hat Enterprise Linux 10 grafana Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/disk-image-cuda-rhel9
    affected: workaround, no fix available “Fix deferred”

21 more affected, 4 more fixed, 4 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-071-03 updated cvss 5.3

Siemens SIDIS Prime

  • Siemens SIDIS Prime < 4.0.800
    affected: fixed in V4.0.800

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
11 mo ago

Exploit prediction

0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm js-yaml
>=4.0.0, <4.1.1
<3.14.2
4.1.1
3.14.2

Affected products

  • nodeca js-yaml

Classification

Weakness
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.