CVE-2019-10773
HIGH 7.8EPSS 1.5%
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
- Affected
- Yarn
- CVSS v3.1 NVD
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 6.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P - EPSS
- 1.52% chance of exploitation in the next 30 days, 74th percentile
- Published
- 2019-12-16
- Updated
- 2024-08-04
Proof-of-concept exploits (1)
Security advisories
- https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn
- yarnpkg/yarn/issues/7761#issuecomment-565493023
- advisories/GHSA-5xf4-f2fq-f69j