https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 15:42:54 +0000 https://db.gcve.eu/vuln/ghsa-mh29-5h37-fv8m <p><strong>Affected:</strong> npm: js-yaml</p> <p>### Impact</p> <p>In js-yaml 4.1.0, 4.0.0, and 3.14.1 and below, it&#39;s possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted.</p> <p>### Patches</p> <p>Problem is patched in js-yaml 4.1.1 and 3.14.2.</p> <p>### Workarounds</p> <p>You can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).</p> <p>### References</p> <p>https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html</p> <p><strong>Affected:</strong> npm: js-yaml</p> <p>### Impact</p> <p>In js-yaml 4.1.0, 4.0.0, and 3.14.1 and below, it&#39;s possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted.</p> <p>### Patches</p> <p>Problem is patched in js-yaml 4.1.1 and 3.14.2.</p> <p>### Workarounds</p> <p>You can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).</p> <p>### References</p> <p>https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html</p> https://db.gcve.eu/vuln/ghsa-mh29-5h37-fv8m