GHSA-8mfc-v7wv-p62g

Path Traversal in Yarn

Source: GitHub Advisory Database (reviewed) High CVE-2020-8131

Packages

Ecosystem	Package	Affected	Fixed in
npm	yarn	< 1.22.0	1.22.0

Details

As written in the advisory (Markdown source, shown as plain text).

Arbitrary filesystem write vulnerability in Yarn 1.21.1 and earlier allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-8131 advisory
https://github.com/yarnpkg/yarn/pull/7831 web
https://hackerone.com/reports/730239 web