CVE-2020-8131

7.5

HIGHCVSS v3

Published

February 24, 2020

CVSS v2

5.1 MEDIUM

Affected

5 projects

Assigned by

[email protected]

Severity scale

010

Description

Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

yarn

NPM📦🐈 Fast, reliable, and secure dependency management.

<= 1.21.1, < 1.22.0NVD

yarnpkg/yarn

GitHubThe 1.x line is frozen - features and bugfixes now happen on https://github.com/yarnpkg/berry

<= 1.21.1, < 1.22.0NVD

Yarn

NuGet Gallery

More on this CVE

NVD↗GitHub Advisory↗

Yet Another Repository for .Net

<= 1.21.1, < 1.22.0NVD

yarn

RubyGemsA multi-process web-server written in Ruby 1.9.

<= 1.21.1, < 1.22.0NVD

thejspr/yarn

GitHubMulti-process webserver written in Ruby. Part of my thesis project.

<= 1.21.1, < 1.22.0NVD

Security Advisories

CVE-2020-8131

Description

More on this CVE