CVE-2020-8131

Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
hackeroneCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 75%
VendorProductVersion
yarnpkgyarn
𝑥
≤ 1.21.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
node-yarnpkg
bullseye
1.22.10+~cs22.25.14-3
fixed
buster
no-dsa
bookworm
1.22.19+~cs24.27.18-2+deb12u1
fixed
sid
4.0.2+dfsg-3
fixed
trixie
4.0.2+dfsg-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
node-yarnpkg
focal
not-affected
eoan
ignored
bionic
dne
xenial
dne
trusty
dne
Common Weakness Enumeration
References
https://github.com/yarnpkg/yarn/pull/7831
https://hackerone.com/reports/730239
https://github.com/yarnpkg/yarn/pull/7831
https://hackerone.com/reports/730239