Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/yui@3.10.0pr1
purl pkg:npm/yui@3.10.0pr1
Next non-vulnerable version 3.11.0pr1
Latest non-vulnerable version 3.11.0pr1
Risk 3.1
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-7pnw-f1rw-kydp
Aliases:
CVE-2013-4939
GHSA-mj87-8xf8-fp4w
XSS via .swf files In the vulnerable versions, the `uploader.swf` and `io.swf` utilities contain a vulnerability allowing cross-site scripting through the `.swf` files used in these components. Through a url accessing these files, and attacker can inject script in the context of these files, potentially exposing cookies or other sensitive information. The vulnerability resurfaced in v0.10.2, but only with `io.swf`.
3.10.0
Affected by 1 other vulnerability.
3.10.3
Affected by 1 other vulnerability.
VCID-bkcw-p2su-pkde
Aliases:
CVE-2013-4940
GHSA-x5hj-47vv-53p8
YUI Cross-site Scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. NOTE: this vulnerability exists because of a CVE-2013-4939 regression.
3.10.11
Affected by 0 other vulnerabilities.
3.10.13
Affected by 0 other vulnerabilities.
3.11.0pr1
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (2)
Vulnerability Summary Aliases
VCID-3fdn-sk73-zqe2 YUI Cross-site Scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. CVE-2013-4942
GHSA-9ww8-j8j2-3788
VCID-kjwa-ezsm-pbg7 YUI Cross-site Scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. CVE-2013-4941
GHSA-64r3-582j-frqm

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-16T21:48:33.020725+00:00 GitLab Importer Affected by VCID-bkcw-p2su-pkde https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4940.yml 38.4.0
2026-04-16T21:47:43.822465+00:00 GitLab Importer Fixing VCID-kjwa-ezsm-pbg7 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4941.yml 38.4.0
2026-04-16T21:47:29.876890+00:00 GitLab Importer Fixing VCID-3fdn-sk73-zqe2 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4942.yml 38.4.0
2026-04-16T20:30:45.625405+00:00 GitLab Importer Affected by VCID-7pnw-f1rw-kydp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4939.yml 38.4.0
2026-04-11T23:04:27.951243+00:00 GitLab Importer Affected by VCID-bkcw-p2su-pkde https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4940.yml 38.3.0
2026-04-11T23:03:34.570920+00:00 GitLab Importer Fixing VCID-kjwa-ezsm-pbg7 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4941.yml 38.3.0
2026-04-11T23:03:19.838397+00:00 GitLab Importer Fixing VCID-3fdn-sk73-zqe2 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4942.yml 38.3.0
2026-04-11T21:41:09.747922+00:00 GitLab Importer Affected by VCID-7pnw-f1rw-kydp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4939.yml 38.3.0
2026-04-02T23:12:49.009192+00:00 GitLab Importer Affected by VCID-bkcw-p2su-pkde https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4940.yml 38.1.0
2026-04-02T23:11:56.934086+00:00 GitLab Importer Fixing VCID-kjwa-ezsm-pbg7 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4941.yml 38.1.0
2026-04-02T23:11:42.728190+00:00 GitLab Importer Fixing VCID-3fdn-sk73-zqe2 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4942.yml 38.1.0
2026-04-02T21:55:20.177774+00:00 GitLab Importer Affected by VCID-7pnw-f1rw-kydp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4939.yml 38.1.0
2026-04-01T17:32:45.546565+00:00 GitLab Importer Affected by VCID-bkcw-p2su-pkde https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4940.yml 38.0.0
2026-04-01T17:31:51.371332+00:00 GitLab Importer Fixing VCID-kjwa-ezsm-pbg7 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4941.yml 38.0.0
2026-04-01T17:31:36.079059+00:00 GitLab Importer Fixing VCID-3fdn-sk73-zqe2 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4942.yml 38.0.0
2026-04-01T16:12:34.646053+00:00 GitLab Importer Affected by VCID-7pnw-f1rw-kydp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4939.yml 38.0.0