Skip to content
OpenAdvisories

Package · Debian

node-yarnpkg

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.7
    CVE-2021-4435

    Yarn: untrusted search path

    An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.

    Fedora Fedora Extra Packages for Enterprise Linux node-yarnpkg Linux Debian Ubuntu npm
  • High 7.5
    CVE-2020-8131

    Path Traversal in Yarn

    Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

    node-yarnpkg yarn Debian npm
  • High 7.8
    CVE-2019-10773

    Yarn Improper link resolution before file access (Link Following)

    In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.

    node-yarnpkg node-yarnpkg yarn Debian Ubuntu npm
  • High 8.1
    CVE-2019-5448

    Missing Encryption of Sensitive Data in yarn

    Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

    yarn yarn node-yarnpkg yarn Debian npm