TI-2019-08038 CVE-2019-10773 · GHSA-5xf4-f2fq-f69j
Link following in Yarn
Priority LOW 37
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys.