TI-2025-07562 CVE-2025-8262 · GHSA-9xhp-f235-5v37
yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos
Priority MEDIUM 57
A vulnerability was found in yarnpkg Yarn up to 1.22.22.
yarnpkg
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
yarnpkg records in CISA KEVNo yarnpkg vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records
TI-2025-08532 CVE-2025-9308 · GHSA-pfv3-xh9q-f4rq
yarnpkg Yarn request-manager.js setOptions redos
Priority MEDIUM 55
A vulnerability has been found in yarnpkg Yarn up to 1.22.22.
TI-2020-06549 CVE-2020-8131 · GHSA-8mfc-v7wv-p62g
Path traversal in yarn
Priority MEDIUM 41
Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
TI-2019-08038 CVE-2019-10773 · GHSA-5xf4-f2fq-f69j
Link following in Yarn
Priority LOW 37
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys.
TI-2021-03291 CVE-2021-4435 · GHSA-mpwj-fcr6-x34c
Yarn: untrusted search path
Priority LOW 36
An untrusted search path vulnerability was found in Yarn.
TI-2019-03856 CVE-2019-5448 · GHSA-wqfc-cr59-h64p
Cleartext transmission of sensitive information in yarn
Priority LOW 36
Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.
TI-2019-11707 CVE-2019-15608 · GHSA-hjxc-462x-x77j
Time-of-check time-of-use race condition in yarn
Priority LOW 30
The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache.
TI-2018-09011 CVE-2018-12556 · GHSA-8mxx-g9vw-r875
The signature verification routine in install.sh in yarnpkg/website through 2018-06-05…
Priority LOW 30
The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature…