Link following in Yarn
Priority LOW 37CWE-59Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.
Summary
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
Why it matters now
EPSS 0.01518 74th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed yarn (npm): 1.22.0Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Yarn | All versions prior to version 1.21.1 | — | No fix listed | CNA |
| — | yarn (npm) | before 1.22.0 | 1.22.0 | Patch available | GHSA-5xf4-f2fq-f69j |
- Yarn Vendor— Affected All versions prior to version 1.21.1 Fixed in — No fix listed CNA
- yarn (npm) Vendor— Affected before 1.22.0 Fixed in 1.22.0 Patch available GHSA-5xf4-f2fq-f69j
Remediation
- Fix · GHSA-5xf4-f2fq-f69j yarn (npm) Fixed in 1.22.0 Advisory →
Red Hat 1 advisory
- RHSA-2020:0475 Released 2020-02-11 · Red Hat rating ImportantRed Hat Quay v3.2.1 security update
- Quay v3 quay3/clair-jwt
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Quay v3 | Fixed | RHSA-2020:0475 |
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10773
- 2026-10-03 Alias added: GHSA-5xf4-f2fq-f69j
References
Exploit 2
Advisory 4
Other 4
- https://github.com/yarnpkg/yarn/pull/7755
- https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn
- https://lists.fedoraproject.org/archives/list/[email protected]/message/3HIZW4NZVV5QY5WWGW2JRP3FHYKZ6ZJ5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ITY5BC63CCC647DFNUQRQ5AJDKUKUNBI
More yarnpkg Yarn vulnerabilities
- TI-2025-07562 yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos CVSS 4.0MEDIUM 5.3
- TI-2025-08532 yarnpkg Yarn request-manager.js setOptions redos CVSS 4.0MEDIUM 4.8
- TI-2020-06549 Path traversal in yarn CVSS 3.1HIGH 7.5
- TI-2021-03291 Yarn: untrusted search path CVSS 3.1HIGH 7.8
- TI-2019-03856 Cleartext transmission of sensitive information in yarn CVSS 3.1HIGH 8.1
- TI-2019-11707 Time-of-check time-of-use race condition in yarn CVSS 3.1MEDIUM 5.9
Sources
- CVE-2019-10773 · CVE Program
- CVE-2019-10773 · NVD
- FIRST EPSS
- GHSA-5xf4-f2fq-f69j · GitHub Advisory Database · CC BY 4.0
- CVE-2019-10773 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences