Skip to content
Sign in
7.7 High

CVE-2021-4435 An untrusted search path vulnerability was found in Yarn

Description

An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.

Affected products and versions

Product Affected versions Fixed in
Yarn 1.22 earliest → < 1.22.13 1.22.13
Fedora Versions not published
Extra Packages for Enterprise Linux Versions not published

Other CVEs of Yarn

The 4 CVEs of Yarn →
CVE-2019-15608 The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before… Not rated CVE-2020-8131 Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem… Not rated CVE-2019-10773 In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host… Not rated
Track this CVE