CVE-2013-4660

nodeca/js-yaml < 2.0.5 - Remote Code Execution via Unsafe YAML Tag Parsing

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2013-4660. PoCs published by Metasploit, leehunkoo, Neal Poole, joev, including Metasploit module exploits/multi/fileformat/nodejs_js_yaml_load_code_exec.

AI-analyzed exploit summary This Metasploit module exploits a code execution vulnerability in the 'js-yaml' Node.js package (versions < 2.0.5) by crafting a malicious YAML file that executes arbitrary JavaScript when parsed via the `load()` function. The exploit leverages YAML's ability to deserialize JavaScript functions, allowing for remote code execution.

Description

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Metasploit · rubylocalmultiple
https://www.exploit-db.com/exploits/28655

This Metasploit module exploits a code execution vulnerability in the 'js-yaml' Node.js package (versions < 2.0.5) by crafting a malicious YAML file that executes arbitrary JavaScript when parsed via the `load()` function. The exploit leverages YAML's ability to deserialize JavaScript functions, allowing for remote code execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: js-yaml Node.js package < 2.0.5
No auth needed
Prerequisites: Target application must parse user-supplied YAML input using the vulnerable `js-yaml` `load()` function
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by leehunkoo · poc
https://github.com/leehunkoo/cve-2013-4660_PoC

This repository contains a functional PoC for CVE-2013-4660, demonstrating a deserialization attack via js-yaml's unsafe `load()` function. The exploit uses a crafted YAML file with a `!!js/function` tag to execute arbitrary JavaScript, leading to environment variable leakage.

Classification
Working Poc 95%
Attack Type
Deserialization
Complexity
Trivial
Reliability
Reliable
Target: js-yaml v2.0.4
No auth needed
Prerequisites: Docker environment · Node.js with js-yaml v2.0.4
mistral-large-3 · analyzed Jun 11, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Neal Poole, joev · rubypocnodejs
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/fileformat/nodejs_js_yaml_load_code_exec.rb

This Metasploit module exploits a deserialization vulnerability in the 'js-yaml' Node.js package (versions < 2.0.5) by leveraging the unsafe !!js/function tag to execute arbitrary JavaScript code when parsing user-supplied YAML input.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: js-yaml Node.js package < 2.0.5
No auth needed
Prerequisites: Target application must parse user-supplied YAML using js-yaml's load() function
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Vendor Advisory x_refsource_confirm
http://portal.nodesecurity.io/advisories/js-yaml

Scores

EPSS 0.1719
EPSS Percentile 96.8%

Details

CWE
CWE-20
Status published
Products (21)
nodeca/js-yaml 0.2.0
nodeca/js-yaml 0.2.1
nodeca/js-yaml 0.2.2
nodeca/js-yaml 0.3.0
nodeca/js-yaml 0.3.1
nodeca/js-yaml 0.3.2
nodeca/js-yaml 0.3.3
nodeca/js-yaml 0.3.4
nodeca/js-yaml 0.3.5
nodeca/js-yaml 0.3.6
... and 11 more
Published Jun 28, 2013
Tracked Since Feb 18, 2026