7.7
Élevée
CVE-2021-4435 An untrusted search path vulnerability was found in Yarn
Description
An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Yarn 1.22 | premières → < 1.22.13 | 1.22.13 |
| Fedora | Versions non publiées | |
| Extra Packages for Enterprise Linux | Versions non publiées |
Références
- access.redhat.com access.redhat.com
- RHBZ#2262284 bugzilla.redhat.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Yarn
Les 4 CVE de Yarn →
CVE-2019-15608
The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before…
Non notée
CVE-2020-8131
Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem…
Non notée
CVE-2019-10773
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host…
Non notée