Yarnpkg Yarn
7 CVEs affecting Yarnpkg Yarn. Latest disclosed: 2025-08-21. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-5448 | High | 8.1 | 2019-07-30 | Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over t… |
CVE-2019-10773 | High | 7.8 | 2019-12-16 | In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" k… |
CVE-2021-4435 | High | 7.7 | 2024-02-04 | An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious c… |
CVE-2020-8131 | High | 7.5 | 2020-02-24 | Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code e… |
CVE-2019-15608 | Medium | 5.9 | 2020-03-15 | The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not comput… |
CVE-2025-8262 | Medium | 4.3 | 2025-07-28 | A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file s… |
CVE-2025-9308 | Low | 3.3 | 2025-08-21 | A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation l… |