{"schema_version":"1.7.2","id":"OESA-2026-1166","modified":"2026-08-06T11:10:12Z","published":"2026-01-16T11:10:12Z","upstream":["CVE-2025-64718"],"summary":"nodejs-js-yaml security update","details":"This is an implementation of YAML (YAML Ain't Markup Language), a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch.  Now it's very fast, and supports the 1.2 spec.\r\n\r\nSecurity Fix(es):\n\njs-yaml is a JavaScript YAML parser and dumper. In js-yaml 4.1.0 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1. Users can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).(CVE-2025-64718)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS-SP2","name":"nodejs-js-yaml","purl":"pkg:rpm/openEuler/nodejs-js-yaml&distro=openEuler-24.03-LTS-SP2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-2.oe2403sp2"}]}],"ecosystem_specific":{"noarch":["nodejs-js-yaml-3.10.0-2.oe2403sp2.noarch.rpm"],"src":["nodejs-js-yaml-3.10.0-2.oe2403sp2.src.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1166"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64718"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"database_specific":{"severity":"Medium"}}