Js-yaml version 3.6.1 represents a minor update to the popular YAML parser and serializer, building upon the foundation laid by version 3.6.0. Both versions share the core functionality of conforming to the YAML 1.2 specification and include the same core dependencies: argparse for command-line argument parsing and esprima for ECMAScript parsing. The developer tooling also remains identical, featuring libraries like browserify, eslint, mocha, and uglify-js for bundling, linting, testing, and minification, respectively.
The primary difference lies in the release date and potentially bug fixes or minor enhancements incorporated in 3.6.1. Released approximately a month after 3.6.0, it suggests a patch addressing issues discovered in the earlier release. For developers, this means opting for version 3.6.1 ensures benefiting from the latest stability improvements, potentially resolving edge-case scenarios or enhancing performance. While the dependency footprint remains unchanged, adopting the newest minor version signifies a proactive approach to code quality and avoids potential pitfalls. The MIT license assures freedom in utilization across diverse projects. Both versions are accessible via the provided npm registry tarballs, facilitating easy integration within Node.js and browser environments. Examining the commit history between these two releases on the GitHub repository (git+https://github.com/nodeca/js-yaml.git) would offer deeper insights into the precise nature of the changes.
All the vulnerabilities related to the version 3.6.1 of the package
Denial of Service in js-yaml
Versions of js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.
Upgrade to version 3.13.0.
Code Injection in js-yaml
Versions of js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file. Objects that have toString as key, JavaScript code as value and are used as explicit mapping keys allow attackers to execute the supplied code through the load() function. The safeLoad() function is unaffected.
An example payload is
{ toString: !<tag:yaml.org,2002:js/function> 'function (){return Date.now()}' } : 1
which returns the object
{
"1553107949161": 1
}
Upgrade to version 3.13.1.
