Skip to main content
cve.nowby Sazabi
← npm
npmPackage

yarn

5 known vulnerabilities (1 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 1 high
Registry
npm

Advisories 5

  • Yarn: untrusted search path

    Affected: fixed in 1.22.13.

  • The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to…

    Affected: fixed in 1.19.0.

  • Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially…

    Affected: fixed in 1.22.0.

  • In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using…

    Affected: fixed in 1.22.0.

  • Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication…

    Affected: fixed in 1.17.3.