CVE-2020-8131

State: Published
Severity: Not scored
Published: Feb 24, 2020
Updated: Aug 4, 2024
Reserved: Jan 28, 2020

Description

Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

Scores

The record has no CVSS score.

Weaknesses

CWE-22 Path Traversal (CWE-22)

Affected Products

Product	Versions
yarnn/a	Fixed Version: 1.22.0Affected

References

https://hackerone.com/reports/730239
https://github.com/yarnpkg/yarn/pull/7831

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.