TOCTOU Race Condition in Yarn

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2019-15608 · ADVISORY
• yarnpkg/yarn commit 0474b8c · WEB
• hackerone.com/reports/703138 · WEB
• yarnpkg/yarn · WEB

yarn のその他の脆弱性

• CVE-2025-9308中 5.5A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. …
• CVE-2025-8262高 7.5A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFra…
• CVE-2021-4435高 7.8An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled c…
• CVE-2020-8131高 7.5Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead …
• CVE-2019-10773高 7.8In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specia…