Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

eemeli/yaml

              main @ 4ecbf76
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Prototype Pollution: 1 prior fix. Scrutinize any change in this area.

src/ast/Pair.js: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Prototype Pollution: Attackers can leverage specific key types like '__proto__' in map definitions to pollute the global Object prototype during the AST parsing phase. This can lead to arbitrary property injection and potential remote code execution depending on downstream application logic.

Denial of Service: Unbounded recursive calls in the node resolution and composition phases allow attackers to trigger a stack overflow and crash the Node.js process using crafted YAML inputs.

Resource Exhaustion: Unbounded alias chasing and parsing of oversized or highly nested YAML structures can cause excessive CPU and memory utilization, resulting in a denial of service.