Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/yui@3.6.0
purl pkg:npm/yui@3.6.0
Next non-vulnerable version 3.11.0pr1
Latest non-vulnerable version 3.11.0pr1
Risk 3.1
Vulnerabilities affecting this package (4)
Vulnerability Summary Fixed by
VCID-3fdn-sk73-zqe2
Aliases:
CVE-2013-4942
GHSA-9ww8-j8j2-3788
YUI Cross-site Scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.
3.10.0pr1
Affected by 2 other vulnerabilities.
VCID-7pnw-f1rw-kydp
Aliases:
CVE-2013-4939
GHSA-mj87-8xf8-fp4w
XSS via .swf files In the vulnerable versions, the `uploader.swf` and `io.swf` utilities contain a vulnerability allowing cross-site scripting through the `.swf` files used in these components. Through a url accessing these files, and attacker can inject script in the context of these files, potentially exposing cookies or other sensitive information. The vulnerability resurfaced in v0.10.2, but only with `io.swf`.
3.10.0
Affected by 1 other vulnerability.
3.10.3
Affected by 1 other vulnerability.
VCID-bkcw-p2su-pkde
Aliases:
CVE-2013-4940
GHSA-x5hj-47vv-53p8
YUI Cross-site Scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. NOTE: this vulnerability exists because of a CVE-2013-4939 regression.
3.10.11
Affected by 0 other vulnerabilities.
3.10.13
Affected by 0 other vulnerabilities.
3.11.0pr1
Affected by 0 other vulnerabilities.
VCID-kjwa-ezsm-pbg7
Aliases:
CVE-2013-4941
GHSA-64r3-582j-frqm
YUI Cross-site Scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.
3.10.0pr1
Affected by 2 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-16T21:48:32.961551+00:00 GitLab Importer Affected by VCID-bkcw-p2su-pkde https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4940.yml 38.4.0
2026-04-16T21:47:43.760003+00:00 GitLab Importer Affected by VCID-kjwa-ezsm-pbg7 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4941.yml 38.4.0
2026-04-16T21:47:29.817147+00:00 GitLab Importer Affected by VCID-3fdn-sk73-zqe2 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4942.yml 38.4.0
2026-04-16T20:30:45.566611+00:00 GitLab Importer Affected by VCID-7pnw-f1rw-kydp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4939.yml 38.4.0
2026-04-11T23:04:27.886470+00:00 GitLab Importer Affected by VCID-bkcw-p2su-pkde https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4940.yml 38.3.0
2026-04-11T23:03:34.496859+00:00 GitLab Importer Affected by VCID-kjwa-ezsm-pbg7 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4941.yml 38.3.0
2026-04-11T23:03:19.774971+00:00 GitLab Importer Affected by VCID-3fdn-sk73-zqe2 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4942.yml 38.3.0
2026-04-11T21:41:09.678327+00:00 GitLab Importer Affected by VCID-7pnw-f1rw-kydp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4939.yml 38.3.0
2026-04-02T23:12:48.950699+00:00 GitLab Importer Affected by VCID-bkcw-p2su-pkde https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4940.yml 38.1.0
2026-04-02T23:11:56.874703+00:00 GitLab Importer Affected by VCID-kjwa-ezsm-pbg7 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4941.yml 38.1.0
2026-04-02T23:11:42.669410+00:00 GitLab Importer Affected by VCID-3fdn-sk73-zqe2 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4942.yml 38.1.0
2026-04-02T21:55:20.119718+00:00 GitLab Importer Affected by VCID-7pnw-f1rw-kydp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4939.yml 38.1.0
2026-04-01T17:32:45.475505+00:00 GitLab Importer Affected by VCID-bkcw-p2su-pkde https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4940.yml 38.0.0
2026-04-01T17:31:51.306410+00:00 GitLab Importer Affected by VCID-kjwa-ezsm-pbg7 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4941.yml 38.0.0
2026-04-01T17:31:36.011992+00:00 GitLab Importer Affected by VCID-3fdn-sk73-zqe2 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4942.yml 38.0.0
2026-04-01T16:12:34.566305+00:00 GitLab Importer Affected by VCID-7pnw-f1rw-kydp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/yui/CVE-2013-4939.yml 38.0.0