Yarnpkg - vulnerabilities (CVEs)
8 CVEs in 2 products, 0 in the last 30 days, newest from 2025-08-21.
Products
Newest CVEs of Yarnpkg
- CVE-2025-9308 - CVSS 5.5 (medium), 2025-08-21: A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation…
- CVE-2025-8262 - CVSS 7.5 (high), 2025-07-28: A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file…
- CVE-2021-4435 - CVSS 7.8 (high), 2024-02-04: An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious…
- CVE-2019-15608 - CVSS 5.9 (medium), 2020-03-15: The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not…
- CVE-2020-8131 - CVSS 7.5 (high), 2020-02-24: Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code…
- CVE-2019-10773 - CVSS 7.8 (high), 2019-12-16: In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin"…
- CVE-2019-5448 - CVSS 8.1 (high), 2019-07-30: Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over…
- CVE-2018-12556 - CVSS 5.9 (medium), 2019-05-16: The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in…
