HIGH7.5

GHSA-8mfc-v7wv-p62g

Path Traversal in Yarn

Quick fix

GHSA-8mfc-v7wv-p62g — yarn: upgrade to the fixed version with the command below.

npm install yarn@1.22.0

Details

Arbitrary filesystem write vulnerability in Yarn 1.21.1 and earlier allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/yarn

Introduced in: 0Fixed in: 1.22.0

Fixnpm install yarn@1.22.0

References

https://nvd.nist.gov/vuln/detail/CVE-2020-8131[ADVISORY]
https://github.com/yarnpkg/yarn/pull/7831[WEB]
https://hackerone.com/reports/730239[WEB]