GHSA-2883-xcg3-v3hh found in npm/js-yaml@3.15.1

GHSA-2883-xcg3-v3hh found in npm/js-yaml@3.15.1

[!important]
Risk: 1.73 (Low)
CVSS: 7.5

Description

Summary

maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit.

Example

arr: &arr [{}, {}, {}, ...] # N empty mappings
targets:
  - <<: *arr                # repeated K times

For every target, the loader iterates all N elements of arr. This results in O(N * K) work while totalMergeKeys remains unchanged.

PoC

import { performance } from 'node:perf_hooks'
import { load, YAML11_SCHEMA } from 'js-yaml'

const n = 20000

const src =
  'arr: &arr [' + '{},'.repeat(n).slice(0, -1) + ']\n' +
  'targets:\n' +
  '  - <<: *arr\n'.repeat(n)

const started = performance.now()

load(src, { schema: YAML11_SCHEMA })

console.log(`${(performance.now() - started).toFixed(1)} ms`)

Observed results:

Impact

An attacker can submit a relatively small YAML document that causes prolonged CPU consumption despite the default maxTotalMergeKeys limit.

Fix

Count each merge-source mapping as one budget unit, in addition to counting its keys.

Difference with v5

In v3 & v4, merge is enabled by default. So, the severity score is higher.

Affected component

The vulnerability is in pkg:npm/js-yaml@3.15.1, found in artifacts pkg:devguard/l3montree-cybersecurity/devguard/devguard-documentation.

Recommended fix

Upgrade to version 3.15.2 or later.

# Update all vulnerable npm packages
npm audit fix
# Update only this package
npm install js-yaml@3.15.2 

Additional guidance for mitigating vulnerabilities

Visit our guides on devguard.org

 %%{init: { 'theme':'base', 'themeVariables': {
'primaryColor': '#F3F3F3',
'primaryTextColor': '#0D1117',
'primaryBorderColor': '#999999',
'lineColor': '#999999',
'secondaryColor': '#ffffff',
'tertiaryColor': '#ffffff'
} }}%%
 flowchart TD
Your_application(["Your application"]) --- pkg_npm_gray_matter_4_0_3(["pkg:npm/gray-matter\@4.0.3"])
pkg_npm_gray_matter_4_0_3(["pkg:npm/gray-matter\@4.0.3"]) --- pkg_npm_js_yaml_3_15_1(["pkg:npm/js-yaml\@3.15.1"])

classDef default stroke-width:2px

Interact with this vulnerability

You can use the following slash commands to interact with this vulnerability:

👍 Reply with this to acknowledge and accept the identified risk.

/accept I accept the risk of this vulnerability, because ...

⚠️ Mark the risk as false positive: Use one of these commands if you believe the reported vulnerability is not actually a valid issue.

/component-not-present The vulnerable component is not included in the artifact.

/vulnerable-code-not-present The component is present, but the vulnerable code is not included or compiled.

/vulnerable-code-not-in-execute-path The vulnerable code exists, but is never executed at runtime.

/vulnerable-code-cannot-be-controlled-by-adversary Built-in protections prevent exploitation of this vulnerability.

/inline-mitigations-already-exist The vulnerable code cannot be controlled or influenced by an attacker.

🔁 Reopen the risk: Use this command to reopen a previously closed or accepted vulnerability.

/reopen ... 

Start by locating the dependency declaration or lockfile that brings in npm/js-yaml@3.15.1, then review the recommended npm update to js-yaml@3.15.2 or later. Done means the vulnerable version is no longer present in the project dependency tree; use npm audit fix or the package-specific install command described in the issue to verify the result.