Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLThtZmMtdjd3di1wNjJn

Path Traversal in Yarn

Arbitrary filesystem write vulnerability in Yarn 1.21.1 and earlier allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

Permalink: https://github.com/advisories/GHSA-8mfc-v7wv-p62g
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLThtZmMtdjd3di1wNjJn
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: 8 months ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Identifiers: GHSA-8mfc-v7wv-p62g, CVE-2020-8131
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-8131
• https://github.com/yarnpkg/yarn/pull/7831
• https://hackerone.com/reports/730239
• https://github.com/advisories/GHSA-8mfc-v7wv-p62g

Affected Packages