CVE-2013-4660: The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/funct...

Security readout for executives and security teams

This issue affects old JS-YAML versions for Node.js. If an application parses YAML supplied by an attacker, a special JavaScript function tag can trigger code execution. Business risk is highest for services that accept uploaded, pasted, or remotely fetched YAML using js-yaml before 2.0.5. Exposure is likely limited to Node.js applications or dependencies using js-yaml before 2.0.5 and parsing attacker-controlled YAML. Systems that do not process untrusted YAML are less likely to be reachable through this CVE. Prioritize remediation if any internet-facing or partner-facing workflow accepts YAML. The impact is code execution, but urgency depends on whether vulnerable parsing is exposed to untrusted input. Mitigation focus: Upgrade js-yaml to version 2.0.5 or later.; Inventory direct and transitive dependencies for vulnerable js-yaml versions.; Avoid parsing untrusted YAML with unsafe JavaScript-specific tags enabled..

Prepared

Jun 14, 2026, 22:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.