CyberRota Analysis
AI-GeneratedThe js-yaml library versions prior to 5.2.1 are vulnerable to a performance issue when parsing crafted ordered-map documents, leading to excessive CPU consumption due to a linear duplicate-key scan. This vulnerability can result in denial-of-service conditions if exploited in applications that rely on this library for YAML parsing. Developers and organizations using affected versions of js-yaml should prioritize upgrading to version 5.2.1 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. This issue is fixed in version 5.2.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)