CVE-2019-15608

The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache

published March 15, 2020

CVSS
—
EPSS
2%
Percentile
78.8
In the wild
Unconfirmed
What it is

The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01836 · 78.8th percentile
Published
2020-03-15T17:08Z
EPSS history
Timeline
  • 15 MAR 17:08Z
    The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache
    cvelistv5