In short
- CVE-2019-5448 is a HIGH (CVSS 8.1) vulnerability affecting yarn (yarnpkg), yarn.
- Chance of exploitation in the next 30 days (EPSS): 0.67%, higher than 52.0% of all vulnerabilities.
- Fix: update to 1.17.3 or later.
| Package | Affected versions | Patched versions |
|---|
| yarn | < 1.17.3
| 1.17.3
|
| yarn npm | < 1.17.3
| 1.17.3
|
Description
Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.
NVD description
Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free