Not rated
CVE-2020-8131 Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem…
Description
Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Yarn | Versions not published |
References
- hackerone.com hackerone.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Yarn
The 4 CVEs of Yarn →
CVE-2021-4435
An untrusted search path vulnerability was found in Yarn
7.7
High
CVE-2019-15608
The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before…
Not rated
CVE-2019-10773
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host…
Not rated