npm package report

Is js-yaml safe?

12 known vulnerabilities, worst severity CRITICAL.

// reach

4 direct dependencies

none carry a known advisory

702 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

cvss

9.0

critical

severity band, no base score published

epss

17.3%

high

chance of exploitation in 30 days, 97th percentile of all CVEs

xyz score

6.9

medium

CyberXYZ composite, a working exploit is published

fig. 01 — GHSA-xxvw-45rp-3mj2, the advisory selected below

// 12 advisories

GHSA-xxvw-45rp-3mj2

CRITICALGitHub ratingCVE-2013-4660

Versions 2.0.4 and earlier of js-yaml are affected by a code execution vulnerability in the YAML deserializer.

// proof of concept

const yaml = require('js-yaml');

const x = `test: !!js/function >
function f() { 
console.log(1); 
}();`

yaml.load(x);

// recommendation

Update js-yaml to version 2.0.5 or later, and ensure that all instances where the .load() method is called are updated to use .safeLoad() instead.

Checked 2026-11-06 at 21:01 UTC. The most recent advisory here was published 2026-09-29. Updated continuously from NVD, GHSA, OSV and CNA feeds.