EUVD-2025-175314Published

js-yaml has prototype pollution in merge (<<)

Collected exploitation and prediction evidence

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

cve-program · CVE-2025-64718

Published

js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).

Source published: 13 Nov 2025 15:32:44 UTC
Source modified: 29 Jan 2026 22:08:30 UTC
Observed here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

euvd · EUVD-2025-175314

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Nov 13, 2025, 3:32:44 PM

dateUpdated: Jan 29, 2026, 10:08:30 PM

18 related source bulletins · separate from aliases

SSA-485750: SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800

ICSA-26-071-03: Siemens SIDIS Prime

openSUSE-SU-2026:20251-1: Security update for cockpit-repos

CVE-2025-13465 · CVE-2025-64718

WID-SEC-W-2026-0153: Oracle Communications: Mehrere Schwachstellen

CVE-2024-12133 · CVE-2024-46901 · CVE-2025-25193 · CVE-2025-26333 · CVE-2025-27533 · CVE-2025-32988 · CVE-2025-32990 · CVE-2025-41249 · CVE-2025-46727 · CVE-2025-48060 · CVE-2025-48734 · CVE-2025-48924 · CVE-2025-48976 · CVE-2025-49844 · CVE-2025-5115 · CVE-2025-5318 · CVE-2025-54571 · CVE-2025-55163 · CVE-2025-58057 · CVE-2025-58098 · CVE-2025-59375 · CVE-2025-5987 · CVE-2025-61795 · CVE-2025-64718 · CVE-2025-65018 · CVE-2025-66418 · CVE-2025-66516 · CVE-2025-68161 · CVE-2025-8194 · CVE-2025-8916 · CVE-2025-9900

SUSE-SU-2026:20182-1: Security update for cockpit-subscriptions

CVE-2025-64718

RHSA-2026:56431: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update

CVE-2025-61726 · CVE-2025-61729 · CVE-2025-64718 · CVE-2025-68470 · CVE-2026-1525 · CVE-2026-1526 · CVE-2026-1527 · CVE-2026-2229 · CVE-2026-6321 · CVE-2026-6322 · CVE-2026-6733 · CVE-2026-6734 · CVE-2026-9358 · CVE-2026-9679 · CVE-2026-9697 · CVE-2026-11525 · CVE-2026-12143 · CVE-2026-12151 · CVE-2026-13149 · CVE-2026-13676 · CVE-2026-22036 · CVE-2026-25645 · CVE-2026-33186 · CVE-2026-33349 · CVE-2026-33671 · CVE-2026-33672 · CVE-2026-33750 · CVE-2026-34043 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-39821 · CVE-2026-40181 · CVE-2026-41305 · CVE-2026-41650 · CVE-2026-41907 · CVE-2026-42342 · CVE-2026-45409 · CVE-2026-45736 · CVE-2026-48779 · CVE-2026-48801 · CVE-2026-53550 · CVE-2026-59869

SUSE-SU-2026:20540-1: Security update for cockpit-repos

CVE-2025-13465 · CVE-2025-64718

openSUSE-SU-2026:20117-1: Security update for cockpit-subscriptions

CVE-2025-64718

RHSA-2026:26411: Red Hat Security Advisory: New container image: rhceph-9.0

CVE-2024-55565 · CVE-2025-47913 · CVE-2025-47914 · CVE-2025-58181 · CVE-2025-59343 · CVE-2025-64718 · CVE-2025-64756

NCSC-2026-0022: Kwetsbaarheden verholpen in Oracle Communications producten

CVE-2024-12133 · CVE-2024-46901 · CVE-2025-5115 · CVE-2025-5318 · CVE-2025-5987 · CVE-2025-8194 · CVE-2025-8916 · CVE-2025-9900 · CVE-2025-25193 · CVE-2025-26333 · CVE-2025-27533 · CVE-2025-32988 · CVE-2025-32990 · CVE-2025-41249 · CVE-2025-46727 · CVE-2025-48060 · CVE-2025-48734 · CVE-2025-48924 · CVE-2025-48976 · CVE-2025-49844 · CVE-2025-54571 · CVE-2025-55163 · CVE-2025-58057 · CVE-2025-58098 · CVE-2025-59375 · CVE-2025-61795 · CVE-2025-64718 · CVE-2025-65018 · CVE-2025-66418 · CVE-2025-66516 · CVE-2025-68161

WID-SEC-W-2025-2909: IBM App Connect Enterprise: Mehrere Schwachstellen

CVE-2025-13466 · CVE-2025-64718 · CVE-2025-64756 · CVE-2025-65945

SUSE-SU-2026:20580-1: Security update for cockpit-repos

CVE-2025-13465 · CVE-2025-64718

RHSA-2026:83548: Red Hat Security Advisory: Red Hat Ceph Storage

CVE-2019-10790 · CVE-2023-25153 · CVE-2023-28155 · CVE-2023-46159 · CVE-2024-5206 · CVE-2024-11831 · CVE-2024-37890 · CVE-2024-47866 · CVE-2025-7783 · CVE-2025-30156 · CVE-2025-47914 · CVE-2025-50181 · CVE-2025-50182 · CVE-2025-58181 · CVE-2025-59436 · CVE-2025-64718 · CVE-2025-64756 · CVE-2026-50152

NCSC-2026-0079: Kwetsbaarheden verholpen in Siemens producten

CVE-2024-29857 · CVE-2024-30171 · CVE-2024-30172 · CVE-2024-41996 · CVE-2025-6965 · CVE-2025-7783 · CVE-2025-9230 · CVE-2025-9232 · CVE-2025-9670 · CVE-2025-12816 · CVE-2025-15284 · CVE-2025-27769 · CVE-2025-40943 · CVE-2025-55018 · CVE-2025-58751 · CVE-2025-58752 · CVE-2025-58754 · CVE-2025-62439 · CVE-2025-62522 · CVE-2025-64157 · CVE-2025-64718 · CVE-2025-64756 · CVE-2025-66030 · CVE-2025-66031 · CVE-2025-66035 · CVE-2025-66412 · CVE-2025-69277 · CVE-2026-22610 · CVE-2026-24858 · CVE-2026-25569 · CVE-2026-25570 · CVE-2026-25571 · CVE-2026-25572 · CVE-2026-25573 · CVE-2026-25605

openSUSE-SU-2026:11126-1: velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media

CVE-2023-45288 · CVE-2024-45339 · CVE-2025-13465 · CVE-2025-22868 · CVE-2025-22869 · CVE-2025-22870 · CVE-2025-22872 · CVE-2025-24358 · CVE-2025-47911 · CVE-2025-58058 · CVE-2025-58181 · CVE-2025-58190 · CVE-2025-5889 · CVE-2025-64718 · CVE-2025-6545 · CVE-2025-6547 · CVE-2025-7783 · CVE-2026-1229 · CVE-2026-25128 · CVE-2026-25680 · CVE-2026-25681 · CVE-2026-26278 · CVE-2026-26996 · CVE-2026-27136 · CVE-2026-2739 · CVE-2026-27606 · CVE-2026-27904 · CVE-2026-33036 · CVE-2026-33186 · CVE-2026-33487 · CVE-2026-33814 · CVE-2026-34986 · CVE-2026-39821 · CVE-2026-39827 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39832 · CVE-2026-39833 · CVE-2026-39834 · CVE-2026-39835 · CVE-2026-42039 · CVE-2026-42502 · CVE-2026-42506 · CVE-2026-42508 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-46598

openSUSE-SU-2026:10036-1: cockpit-repos-4.6-1.1 on GA media

CVE-2025-64718

SUSE-SU-2026:20170-1: Security update for cockpit-subscriptions

CVE-2025-64718

RHSA-2026:15979: Red Hat Security Advisory: Red Hat Ceph Storage

CVE-2025-13033 · CVE-2025-47914 · CVE-2025-58181 · CVE-2025-61729 · CVE-2025-64718 · CVE-2025-64756 · CVE-2025-68156

Source published: Nov 13, 2025, 3:32:44 PM (timezone not stated)
Source modified: Jan 29, 2026, 10:08:30 PM (timezone not stated)
Observed here: 11 Nov 2026 04:32:03 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

nvd · CVE-2025-64718

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-1321

Original publisher date fields

published: 2025-11-13T16:15:57.153

lastModified: 2026-10-07T21:10:00.200

1 source CPE criteria · context only

cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Source published: 13 Nov 2025 16:15:57 UTC
Source modified: 7 Oct 2026 21:10:00 UTC
Observed here: 25 Oct 2026 03:17:29 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

osv · GHSA-mh29-5h37-fv8m

Published

### Impact In js-yaml 4.1.0, 4.0.0, and 3.14.1 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. ### Patches Problem is patched in js-yaml 4.1.1 and 3.14.2. ### Workarounds You can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default). ### References https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html

Source published: 14 Nov 2025 14:29:48 UTC
Source modified: 10 Sep 2026 03:50:58 UTC
Observed here: 24 Oct 2026 13:17:17 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Publisher rating · MODERATE