GitHub Advisoryadvisory · npm

GHSA-mpwj-fcr6-x34c Yarn untrusted search path vulnerability

HIGH Published 2024-02-04 Modified 2024-02-05 Official page ↗
Aliases
CVE-2021-4435
Ecosystem
npm
Packages
yarn
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-426
Reviewed
2024-02-05

Affected packages

• npm yarn: < 1.22.13 → fixed in 1.22.13

Description

An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.

Related

Alias · CVE (1)

  • CVE-2021-4435 An untrusted search path vulnerability was found in Yarn. vulnerability

Weakness · CWE (1)

  • CWE-426 Untrusted Search Path weakness

References