Yarn
Yarnpkg · 7 CVEs
CVE-2025-9308
MEDIUM
yarnpkg Yarn request-manager.js setOptions redos
Aug 21, 2025
CVE-2025-8262
MEDIUM
yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos
Jul 28, 2025
CVE-2021-4435
HIGH
Yarn: untrusted search path
Feb 4, 2024
CVE-2019-15608
MEDIUM
yarn: TOCTOU vulnerability leads to cache pollution
Mar 15, 2020
CVE-2020-8131
HIGH
yarn: Arbitrary filesystem write via tar expansion
Feb 24, 2020
CVE-2019-10773
HIGH
nodejs-yarn: Install functionality can be abused to generate arbitrary symlinks
Dec 16, 2019
CVE-2019-5448
HIGH
Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypt…
Jul 30, 2019
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2025-9308 | yarnpkg Yarn request-manager.js setOptions redos | MEDIUM | 0.21% | Aug 21, 2025 |
| CVE-2025-8262 | yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos | MEDIUM | 0.74% | Jul 28, 2025 |
| CVE-2021-4435 | Yarn: untrusted search path | HIGH | 0.30% | Feb 4, 2024 |
| CVE-2019-15608 | yarn: TOCTOU vulnerability leads to cache pollution | MEDIUM | 1.84% | Mar 15, 2020 |
| CVE-2020-8131 | yarn: Arbitrary filesystem write via tar expansion | HIGH | 5.16% | Feb 24, 2020 |
| CVE-2019-10773 | nodejs-yarn: Install functionality can be abused to generate arbitrary symlinks | HIGH | 1.52% | Dec 16, 2019 |
| CVE-2019-5448 | Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over t… | HIGH | 0.67% | Jul 30, 2019 |
Showing 1 to 7 of 7 CVEs