{"action":"Upgrade js-yaml to 3.14.2 or later.","affected":[{"fixed":"4.1.1","introduced":"4.0.0"},{"fixed":"3.14.2","introduced":"0"}],"component":"js-yaml","cve_ids":["CVE-2025-64718"],"ecosystem":"npm","epss":0.00423,"exploited":false,"fixed_versions":["4.1.1","3.14.2"],"ghsa_id":"GHSA-mh29-5h37-fv8m","id":"tcs_01M5KG0Q92CT6M3B8MB9KPRBWV","modified_at":"2026-09-10T03:50:58.469126910Z","published_at":"2025-11-14T14:29:48Z","references":["https://osv.dev/vulnerability/GHSA-mh29-5h37-fv8m","https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://nvd.nist.gov/vuln/detail/CVE-2025-64718","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876","https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/advisories/GHSA-mh29-5h37-fv8m","https://github.com/nodeca/js-yaml"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-mh29-5h37-fv8m","url":"https://osv.dev/vulnerability/GHSA-mh29-5h37-fv8m"}],"summary":"js-yaml has prototype pollution in merge (<<)"}