Non notée
CVE-2019-10773 In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host…
Description
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Yarn | Versions non publiées |
Références
- snyk.io snyk.io
- github.com github.com
- github.com github.com
- blog.daniel-ruf.de blog.daniel-ruf.de
- FEDORA-2020-766ce5adae lists.fedoraproject.org
- FEDORA-2020-7525beefa1 lists.fedoraproject.org
- RHSA-2020:0475 access.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Yarn
Les 4 CVE de Yarn →
CVE-2021-4435
An untrusted search path vulnerability was found in Yarn
7.7
Élevée
CVE-2019-15608
The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before…
Non notée
CVE-2020-8131
Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem…
Non notée