{"id":"EUVD-2025-175314","revision":"a79fc0f0143e471aaab5bac9634766b2","records":[{"revision":"a79fc0f0143e471aaab5bac9634766b2","observedAt":"2026-11-03T02:08:07.745+00:00","statement":{"source":"euvd","id":"EUVD-2025-175314","aliases":["CVE-2025-64718","GHSA-mh29-5h37-fv8m"],"title":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse unt…","description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3,"severity":null}],"references":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876","https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-175314","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 13, 2025, 3:32:44 PM","dateUpdated":"Jan 29, 2026, 10:08:30 PM"},"relatedAdvisories":[{"id":"SSA-485750","title":"SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800","vulnerabilityIds":["CVE-2024-29857","CVE-2024-30171","CVE-2024-30172","CVE-2024-41996","CVE-2025-6965","CVE-2025-7783","CVE-2025-9230","CVE-2025-9232","CVE-2025-9670","CVE-2025-12816","CVE-2025-15284","CVE-2025-58751","CVE-2025-58752","CVE-2025-58754","CVE-2025-62522","CVE-2025-64718","CVE-2025-64756","CVE-2025-66030","CVE-2025-66031","CVE-2025-66035","CVE-2025-66412","CVE-2025-69277","CVE-2026-22610"]},{"id":"ICSA-26-071-03","title":"Siemens SIDIS Prime","vulnerabilityIds":["CVE-2024-29857","CVE-2024-30171","CVE-2024-30172","CVE-2024-41996","CVE-2025-6965","CVE-2025-7783","CVE-2025-9230","CVE-2025-9232","CVE-2025-9670","CVE-2025-12816","CVE-2025-15284","CVE-2025-58751","CVE-2025-58752","CVE-2025-58754","CVE-2025-62522","CVE-2025-64718","CVE-2025-64756","CVE-2025-66030","CVE-2025-66031","CVE-2025-66035","CVE-2025-66412","CVE-2025-69277","CVE-2026-22610"]},{"id":"openSUSE-SU-2026:20251-1","title":"Security update for cockpit-repos","vulnerabilityIds":["CVE-2025-13465","CVE-2025-64718"]},{"id":"WID-SEC-W-2026-0153","title":"Oracle Communications: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2024-12133","CVE-2024-46901","CVE-2025-25193","CVE-2025-26333","CVE-2025-27533","CVE-2025-32988","CVE-2025-32990","CVE-2025-41249","CVE-2025-46727","CVE-2025-48060","CVE-2025-48734","CVE-2025-48924","CVE-2025-48976","CVE-2025-49844","CVE-2025-5115","CVE-2025-5318","CVE-2025-54571","CVE-2025-55163","CVE-2025-58057","CVE-2025-58098","CVE-2025-59375","CVE-2025-5987","CVE-2025-61795","CVE-2025-64718","CVE-2025-65018","CVE-2025-66418","CVE-2025-66516","CVE-2025-68161","CVE-2025-8194","CVE-2025-8916","CVE-2025-9900"]},{"id":"SUSE-SU-2026:20182-1","title":"Security update for cockpit-subscriptions","vulnerabilityIds":["CVE-2025-64718"]},{"id":"RHSA-2026:56431","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update","vulnerabilityIds":["CVE-2025-61726","CVE-2025-61729","CVE-2025-64718","CVE-2025-68470","CVE-2026-1525","CVE-2026-1526","CVE-2026-1527","CVE-2026-2229","CVE-2026-6321","CVE-2026-6322","CVE-2026-6733","CVE-2026-6734","CVE-2026-9358","CVE-2026-9679","CVE-2026-9697","CVE-2026-11525","CVE-2026-12143","CVE-2026-12151","CVE-2026-13149","CVE-2026-13676","CVE-2026-22036","CVE-2026-25645","CVE-2026-33186","CVE-2026-33349","CVE-2026-33671","CVE-2026-33672","CVE-2026-33750","CVE-2026-34043","CVE-2026-34986","CVE-2026-35469","CVE-2026-39821","CVE-2026-40181","CVE-2026-41305","CVE-2026-41650","CVE-2026-41907","CVE-2026-42342","CVE-2026-45409","CVE-2026-45736","CVE-2026-48779","CVE-2026-48801","CVE-2026-53550","CVE-2026-59869"]},{"id":"SUSE-SU-2026:20540-1","title":"Security update for cockpit-repos","vulnerabilityIds":["CVE-2025-13465","CVE-2025-64718"]},{"id":"openSUSE-SU-2026:20117-1","title":"Security update for cockpit-subscriptions","vulnerabilityIds":["CVE-2025-64718"]},{"id":"RHSA-2026:26411","title":"Red Hat Security Advisory: New container image: rhceph-9.0","vulnerabilityIds":["CVE-2024-55565","CVE-2025-47913","CVE-2025-47914","CVE-2025-58181","CVE-2025-59343","CVE-2025-64718","CVE-2025-64756"]},{"id":"NCSC-2026-0022","title":"Kwetsbaarheden verholpen in Oracle Communications producten","vulnerabilityIds":["CVE-2024-12133","CVE-2024-46901","CVE-2025-5115","CVE-2025-5318","CVE-2025-5987","CVE-2025-8194","CVE-2025-8916","CVE-2025-9900","CVE-2025-25193","CVE-2025-26333","CVE-2025-27533","CVE-2025-32988","CVE-2025-32990","CVE-2025-41249","CVE-2025-46727","CVE-2025-48060","CVE-2025-48734","CVE-2025-48924","CVE-2025-48976","CVE-2025-49844","CVE-2025-54571","CVE-2025-55163","CVE-2025-58057","CVE-2025-58098","CVE-2025-59375","CVE-2025-61795","CVE-2025-64718","CVE-2025-65018","CVE-2025-66418","CVE-2025-66516","CVE-2025-68161"]},{"id":"WID-SEC-W-2025-2909","title":"IBM App Connect Enterprise: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2025-13466","CVE-2025-64718","CVE-2025-64756","CVE-2025-65945"]},{"id":"SUSE-SU-2026:20580-1","title":"Security update for cockpit-repos","vulnerabilityIds":["CVE-2025-13465","CVE-2025-64718"]},{"id":"RHSA-2026:83548","title":"Red Hat Security Advisory: Red Hat Ceph Storage","vulnerabilityIds":["CVE-2019-10790","CVE-2023-25153","CVE-2023-28155","CVE-2023-46159","CVE-2024-5206","CVE-2024-11831","CVE-2024-37890","CVE-2024-47866","CVE-2025-7783","CVE-2025-30156","CVE-2025-47914","CVE-2025-50181","CVE-2025-50182","CVE-2025-58181","CVE-2025-59436","CVE-2025-64718","CVE-2025-64756","CVE-2026-50152"]},{"id":"NCSC-2026-0079","title":"Kwetsbaarheden verholpen in Siemens producten","vulnerabilityIds":["CVE-2024-29857","CVE-2024-30171","CVE-2024-30172","CVE-2024-41996","CVE-2025-6965","CVE-2025-7783","CVE-2025-9230","CVE-2025-9232","CVE-2025-9670","CVE-2025-12816","CVE-2025-15284","CVE-2025-27769","CVE-2025-40943","CVE-2025-55018","CVE-2025-58751","CVE-2025-58752","CVE-2025-58754","CVE-2025-62439","CVE-2025-62522","CVE-2025-64157","CVE-2025-64718","CVE-2025-64756","CVE-2025-66030","CVE-2025-66031","CVE-2025-66035","CVE-2025-66412","CVE-2025-69277","CVE-2026-22610","CVE-2026-24858","CVE-2026-25569","CVE-2026-25570","CVE-2026-25571","CVE-2026-25572","CVE-2026-25573","CVE-2026-25605"]},{"id":"openSUSE-SU-2026:11126-1","title":"velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media","vulnerabilityIds":["CVE-2023-45288","CVE-2024-45339","CVE-2025-13465","CVE-2025-22868","CVE-2025-22869","CVE-2025-22870","CVE-2025-22872","CVE-2025-24358","CVE-2025-47911","CVE-2025-58058","CVE-2025-58181","CVE-2025-58190","CVE-2025-5889","CVE-2025-64718","CVE-2025-6545","CVE-2025-6547","CVE-2025-7783","CVE-2026-1229","CVE-2026-25128","CVE-2026-25680","CVE-2026-25681","CVE-2026-26278","CVE-2026-26996","CVE-2026-27136","CVE-2026-2739","CVE-2026-27606","CVE-2026-27904","CVE-2026-33036","CVE-2026-33186","CVE-2026-33487","CVE-2026-33814","CVE-2026-34986","CVE-2026-39821","CVE-2026-39827","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39833","CVE-2026-39834","CVE-2026-39835","CVE-2026-42039","CVE-2026-42502","CVE-2026-42506","CVE-2026-42508","CVE-2026-46595","CVE-2026-46597","CVE-2026-46598"]},{"id":"openSUSE-SU-2026:10036-1","title":"cockpit-repos-4.6-1.1 on GA media","vulnerabilityIds":["CVE-2025-64718"]},{"id":"SUSE-SU-2026:20170-1","title":"Security update for cockpit-subscriptions","vulnerabilityIds":["CVE-2025-64718"]},{"id":"RHSA-2026:15979","title":"Red Hat Security Advisory: Red Hat Ceph Storage","vulnerabilityIds":["CVE-2025-13033","CVE-2025-47914","CVE-2025-58181","CVE-2025-61729","CVE-2025-64718","CVE-2025-64756","CVE-2025-68156"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-175314","identifiers":["EUVD-2025-175314","CVE-2025-64718","GHSA-mh29-5h37-fv8m"]},"retained":false,"historicalAffected":[]}],"coverage":[]}