Not rated
CVE-2019-10773 In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host…
Description
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Yarn | Versions not published |
Other CVEs of Yarn
The 4 CVEs of Yarn →
CVE-2021-4435
An untrusted search path vulnerability was found in Yarn
7.7
High
CVE-2019-15608
The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before…
Not rated
CVE-2020-8131
Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem…
Not rated