Not rated
CVE-2019-10773 In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host…
Description
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Yarn | Versions not published |
References
- snyk.io snyk.io
- github.com github.com
- github.com github.com
- blog.daniel-ruf.de blog.daniel-ruf.de
- FEDORA-2020-766ce5adae lists.fedoraproject.org
- FEDORA-2020-7525beefa1 lists.fedoraproject.org
- RHSA-2020:0475 access.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Yarn
The 4 CVEs of Yarn →
CVE-2021-4435
An untrusted search path vulnerability was found in Yarn
7.7
High
CVE-2019-15608
The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before…
Not rated
CVE-2020-8131
Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem…
Not rated