Prototype pollution in js-yaml (npm) - CVE-2025-64718

Vulnerability identifier: #VU121666

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-64718

CWE-ID: CWE-1321

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation. A remote attacker can pass specially crafted input to the application and perform prototype pollution attacks.

js-yaml (npm)
watsonx Orchestrate Developer Edition
Guardium Data Security Center (GDSC)
Data Product Hub
watsonx.data integration
IBM Business Automation Manager Open Editions
Maximo Application Suite Ai Service
Maximo Application Suite - Visual Inspection Component
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
MongoDB Enterprise Advanced with IBM
IBM Process Mining
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Sterling Connect:Direct Web Services
IBM Maximo Application Suite - Manage Component
App Connect Enterprise Certified Container
Communications Unified Assurance
Event Streams
Fedora
openEuler
IBM App Connect Enterprise
yarnpkg
nodejs-js-yaml

Install update from vendor's website.

js-yaml (npm) - update to 4.1.1
watsonx Orchestrate Developer Edition - update to 2.3.0
IBM Process Mining - update to 2.1.0
Guardium Data Security Center (GDSC) - update to 3.8.8
Data Product Hub - update to 5.3.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.1
watsonx.data integration - update to 5.3.1
IBM Sterling Connect:Direct Web Services - update to 6.3.0.19
IBM Maximo Application Suite - Manage Component - addressed in versions 9.0.21, 9.1.8
IBM Business Automation Manager Open Editions - update to 9.3.1
Maximo Application Suite Ai Service - update to 9.1.10
Maximo Application Suite - Visual Inspection Component - update to 9.2.1
Event Streams - update to 12.2.2
IBM App Connect Enterprise - addressed in versions 12.0.12.21, 13.0.6.0
yarnpkg - addressed in versions 1.22.22-17.el10_3, 1.22.22-17.fc42, 1.22.22-17.fc43, 1.22.22-17.fc44, 1.22.22-18.fc43
nodejs-js-yaml - update to 3.10.0-2
watsonx Assistant Cartridge - update to 5.4
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.4
MongoDB Enterprise Advanced with IBM - addressed in versions 7.0.21, 8.0.18
App Connect Enterprise Certified Container - addressed in versions 12.0.22, 12.19.0

• https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879
• https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m

• Prototype pollution in js-yaml
• openEuler 24.03 LTS SP1 update for nodejs-js-yaml
• openEuler 24.03 LTS update for nodejs-js-yaml
• openEuler 22.03 LTS SP4 update for nodejs-js-yaml
• openEuler 22.03 LTS SP3 update for nodejs-js-yaml
• openEuler 20.03 LTS SP4 update for nodejs-js-yaml
• openEuler 24.03 LTS SP2 update for nodejs-js-yaml
• Multiple vulnerabilities in IBM Maximo AI Service
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Data Product Hub
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in IBM Process Mining
• IBM Maximo Application Suite - Manage Component update for js-yaml
• MongoDB Enterprise Advanced with IBM update for js-yaml
• IBM Watson Discovery Cartridge update for js-yaml
• Fedora 42 update for yarnpkg
• Fedora EPEL 10.3 update for yarnpkg
• Fedora 44 update for yarnpkg
• Fedora 43 update for yarnpkg
• Multiple vulnerabilities in IBM Event Streams
• Multiple vulnerabilities in IBM watsonx.data integration
• Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition
• Multiple vulnerabilities in IBM Guardium Data Security Center
• IBM App Connect Enterprise Certified Container update for js-yaml
• Fedora 43 update for yarnpkg
• IBM Sterling Connect:Direct Web Services update for js-yaml
• IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge update for js-yaml
• Multiple vulnerabilities in IBM Maximo Application Suite - Visual Inspection Component