yarn

3 results · Clear filters · Feed

• High 7.7
  CVE-2021-4435

  Yarn: untrusted search path

  An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.

  Fedora Fedora Extra Packages for Enterprise Linux node-yarnpkg Linux Debian Ubuntu Wolfi npm
  Feb 4, 2024
• High 7.8
  CVE-2019-10773

  Yarn Improper link resolution before file access (Link Following)

  In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.

  node-yarnpkg node-yarnpkg yarn yarn Debian Ubuntu Wolfi npm
  Dec 16, 2019
• High 8.1
  CVE-2019-5448

  Missing Encryption of Sensitive Data in yarn

  Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

  yarn yarn node-yarnpkg yarn Debian Wolfi npm
  Jul 30, 2019