GitHub Advisoryadvisory · npm

GHSA-8mfc-v7wv-p62g Path Traversal in Yarn

HIGH Published 2022-02-09 Modified 2021-04-08 Official page ↗
Aliases
CVE-2020-8131
Ecosystem
npm
Packages
yarn
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2021-04-08

Affected packages

• npm yarn: < 1.22.0 → fixed in 1.22.0

Description

Arbitrary filesystem write vulnerability in Yarn 1.21.1 and earlier allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

Related

Alias · CVE (1)

  • CVE-2020-8131 Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References