CVE-2019-10773

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin"…

published December 16, 2019

CVSS
—
EPSS
2%
Percentile
74.4
In the wild
Unconfirmed
What it is

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01518 · 74.4th percentile
Published
2019-12-16T19:31Z
EPSS history
Timeline
  • 16 DEC 19:31Z
    In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin"…
    cvelistv5