CyberRota Analysis
AI-GeneratedThe js-yaml library, specifically versions 5.0.0 to 5.1.0, is vulnerable to a performance issue that can lead to excessive CPU consumption when parsing documents that utilize merge keys in a specific manner. This vulnerability can be exploited to degrade application performance, making it particularly relevant for developers and organizations using js-yaml in their JavaScript projects. Users should prioritize upgrading to version 5.2.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)