Missing Encryption of Sensitive Data in yarn

Description

References

• nvd.nist.gov/vuln/detail/CVE-2019-5448 · ADVISORY
• hackerone.com/reports/640904 · WEB
• ChALkeR/notes · WEB
• yarnpkg.com/blog/2019/07/12/recommended-security-update · WEB
• yarnpkg.com/blog/2019/07/12/recommended-security-update · Vendor Advisory

Weitere Schwachstellen in yarn

• CVE-2025-9308MITTEL 5.5A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. …
• CVE-2025-8262HOCH 7.5A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFra…
• CVE-2021-4435HOCH 7.8An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled c…
• CVE-2019-15608MITTEL 5.9The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cac…
• CVE-2020-8131HOCH 7.5Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead …