Prototype pollution in js-yaml (npm) - CVE-2025-64718

Vulnerability identifier: #VU121666

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-64718

CWE-ID: CWE-1321

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation. A remote attacker can pass specially crafted input to the application and perform prototype pollution attacks.

js-yaml (npm)
Event Processing
watsonx Orchestrate Developer Edition
Guardium Data Security Center (GDSC)
Data Product Hub
watsonx.data integration
IBM Business Automation Manager Open Editions
Maximo Application Suite Ai Service
Maximo Application Suite - Visual Inspection Component
IBM Event Endpoint Management
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
MongoDB Enterprise Advanced with IBM
IBM Virtualization Engine TS7700 3948-VED
System Storage Virtualization Engine TS7700 3948-VEF
IBM Process Mining
PowerVC
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Sterling Connect:Direct Web Services
IBM Maximo Application Suite - Manage Component
App Connect Enterprise Certified Container
Communications Unified Assurance
Event Streams
Fedora
openEuler
IBM App Connect Enterprise
yarnpkg
nodejs-js-yaml
Virtualization Engine TS7700 3957-VED

Install update from vendor's website.

js-yaml (npm) - update to 4.1.1
Event Processing - update to 1.5.5
watsonx Orchestrate Developer Edition - update to 2.3.0
IBM Process Mining - update to 2.1.0
Guardium Data Security Center (GDSC) - update to 3.8.8
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.1
Data Product Hub - update to 5.3.0
watsonx.data integration - update to 5.3.1
IBM Sterling Connect:Direct Web Services - update to 6.3.0.19
IBM Business Automation Manager Open Editions - update to 9.3.1
IBM Maximo Application Suite - Manage Component - addressed in versions 9.0.21, 9.1.8
Maximo Application Suite Ai Service - update to 9.1.10
Maximo Application Suite - Visual Inspection Component - update to 9.2.1
Event Streams - update to 12.2.2
IBM Event Endpoint Management - update to 11.8.2
IBM App Connect Enterprise - addressed in versions 12.0.12.21, 13.0.6.0
yarnpkg - addressed in versions 1.22.22-17.el10_3, 1.22.22-17.fc42, 1.22.22-17.fc43, 1.22.22-17.fc44, 1.22.22-18.fc43
nodejs-js-yaml - update to 3.10.0-2
watsonx Assistant Cartridge - update to 5.4
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.4
MongoDB Enterprise Advanced with IBM - addressed in versions 7.0.21, 8.0.18
IBM Virtualization Engine TS7700 3948-VED - addressed in versions 8.60.0.115 VTD_EXEC.905, 8.60.0.116 VTD_EXEC.905, 8.61.0.60 VTD_EXEC.906
System Storage Virtualization Engine TS7700 3948-VEF - addressed in versions 8.60.0.115 VTD_EXEC.905, 8.60.0.116 VTD_EXEC.905, 8.61.0.60 VTD_EXEC.906
Virtualization Engine TS7700 3957-VED - addressed in versions 8.60.0.115 VTD_EXEC.905, 8.60.0.116 VTD_EXEC.905, 8.61.0.60 VTD_EXEC.906
App Connect Enterprise Certified Container - addressed in versions 12.0.22, 12.19.0

• https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879
• https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m

• Prototype pollution in js-yaml
• openEuler 24.03 LTS SP1 update for nodejs-js-yaml
• openEuler 24.03 LTS update for nodejs-js-yaml
• openEuler 22.03 LTS SP4 update for nodejs-js-yaml
• openEuler 22.03 LTS SP3 update for nodejs-js-yaml
• openEuler 20.03 LTS SP4 update for nodejs-js-yaml
• openEuler 24.03 LTS SP2 update for nodejs-js-yaml
• Multiple vulnerabilities in IBM Maximo AI Service
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Data Product Hub
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in IBM Process Mining
• IBM Maximo Application Suite - Manage Component update for js-yaml
• MongoDB Enterprise Advanced with IBM update for js-yaml
• IBM Watson Discovery Cartridge update for js-yaml
• Fedora 42 update for yarnpkg
• Fedora EPEL 10.3 update for yarnpkg
• Fedora 44 update for yarnpkg
• Fedora 43 update for yarnpkg
• Multiple vulnerabilities in IBM Event Streams
• Multiple vulnerabilities in IBM watsonx.data integration
• Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition
• Multiple vulnerabilities in IBM Guardium Data Security Center
• IBM App Connect Enterprise Certified Container update for js-yaml
• Fedora 43 update for yarnpkg
• IBM Sterling Connect:Direct Web Services update for js-yaml
• IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge update for js-yaml
• Multiple vulnerabilities in IBM Maximo Application Suite - Visual Inspection Component
• Multiple vulnerabilities in IBM System Storage Virtualization Engine TS7700
• Multiple vulnerabilities in IBM Event Processing
• Multiple vulnerabilities in IBM Event Endpoint Management
• Multiple vulnerabilities in IBM PowerVC