CVE-2025-8262

yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos

State: Published
Severity: 5.3 Medium
Published: Jul 28, 2025
Updated: Jul 28, 2025
Reserved: Jul 26, 2025

Description

A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The patch is identified as 97731871e674bf93bcbf29e9d3258da8685f3076. It is recommended to apply a patch to fix this issue.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C	VulDB
2.0	4.0 Medium	AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-1333 Inefficient Regular Expression Complexity
CWE-400 Resource Consumption

Affected Products

Product	Versions
Yarnyarnpkg	1.22.0Affected 1.22.1Affected 1.22.2Affected 1.22.3Affected 1.22.4Affected 1.22.5Affected 1.22.6Affected 1.22.7Affected 1.22.8Affected 1.22.9Affected 1.22.10Affected 1.22.11Affected 1.22.12Affected 1.22.13Affected 1.22.14Affected 1.22.15Affected 1.22.16Affected 1.22.17Affected 1.22.18Affected 1.22.19Affected 1.22.20Affected 1.22.21Affected 1.22.22Affected

References

VDB-317850 | yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redosvdb-entrytechnical-description
VDB-317850 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #617393 | Yarn v1.22.22 Inefficient Regular Expression Complexitythird-party-advisory
https://github.com/yarnpkg/yarn/pull/9199issue-tracking
https://github.com/yarnpkg/yarn/pull/9199/commits/97731871e674bf93bcbf29e9d3258da8685f3076issue-trackingpatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.