GitHub Advisoryadvisory · npm

GHSA-5xf4-f2fq-f69j Yarn Improper link resolution before file access (Link Following)

HIGH Published 2020-02-14 Modified 2023-09-08 Official page ↗
Aliases
CVE-2019-10773
Ecosystem
npm
Packages
yarn
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2020-02-13

Affected packages

• npm yarn: < 1.22.0 → fixed in 1.22.0

Description

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.

Related

Alias · CVE (1)

  • CVE-2019-10773 In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References