GHSA-f9xv-q969-pqx4 CVE-2023-2251
Uncaught Exception in yaml
High
npm
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 1.09%
- Chance of exploitation in the next 30 days. Higher than 65.44% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-248 Uncaught Exception
- Fix
2.2.2- Upgrade yaml to this version or later
Description
Uncaught Exception in GitHub repository eemeli/yaml starting at version 2.0.0-5 and prior to 2.2.2.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| yaml | >= 2.0.0-5, < 2.2.2 |
2.2.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
yaml npm → 2.2.2
- npm
npm install yaml@2.2.2- yarn
yarn add yaml@2.2.2- pnpm
pnpm add yaml@2.2.2
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-248: Uncaught Exception
An exception is thrown from a function, but it is not caught.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-48c2-rrv3-qjmp yaml is vulnerable to Stack Overflow via deeply nested YAML collections | Medium | Also affects yaml |
| GHSA-8hrf-8g6f-7xwp Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message | High | Same weakness, CWE-248 |
| GHSA-27r3-jxmh-p828 body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body | High | Same weakness, CWE-248 |
| GHSA-9pvw-hwfg-92h5 Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type | Medium | Same weakness, CWE-248 |
| GHSA-55wc-3pg8-jfw6 undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor | High | Same weakness, CWE-248 |
| GHSA-qrxm-fqhp-jwvm undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation | High | Same weakness, CWE-248 |
| GHSA-xjj6-f33q-929c undici vulnerable to Denial of Service via unhandled error on excessive content-encodings | High | Same weakness, CWE-248 |
| GHSA-qq8j-7v2v-3rwp undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake | High | Same weakness, CWE-248 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor