Known Vulnerabilities for Yarn by Yarnpkg
Listed below are 4 of the newest known vulnerabilities associated with "Yarn" by "Yarnpkg".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-45772 json | Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo ... | Not Provided | 2026-05-15 | 2026-05-15 |
| CVE-2020-8131 json | Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and po... | 7.5 - HIGH | 2020-02-24 | 2020-03-24 |
| CVE-2019-15608 json | The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a... | 5.9 - MEDIUM | 2020-03-15 | 2020-03-21 |
| CVE-2019-10773 json | In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem ... | 7.8 - HIGH | 2019-12-16 | 2023-11-07 |
| CVE-2019-5448 json | Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted aut... | 8.1 - HIGH | 2019-07-30 | 2021-11-03 |
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Yarnpkg | Yarn | 1.9.4 | |||
| Application | Yarnpkg | Yarn | 1.9.3 | |||
| Application | Yarnpkg | Yarn | 1.9.2 | |||
| Application | Yarnpkg | Yarn | 1.9.1 | |||
| Application | Yarnpkg | Yarn | 1.9.0 | |||
| Application | Yarnpkg | Yarn | 1.8.0 | |||
| Application | Yarnpkg | Yarn | 1.7.0 | |||
| Application | Yarnpkg | Yarn | 1.6.0 | |||
| Application | Yarnpkg | Yarn | 1.5.1 | |||
| Application | Yarnpkg | Yarn | 1.5.0 | |||
| Application | Yarnpkg | Yarn | 1.4.1 | |||
| Application | Yarnpkg | Yarn | 1.4.0 | |||
| Application | Yarnpkg | Yarn | 1.3.2 | |||
| Application | Yarnpkg | Yarn | 1.3.1 | |||
| Application | Yarnpkg | Yarn | 1.3.0 | |||
| Application | Yarnpkg | Yarn | 1.21.1 | |||
| Application | Yarnpkg | Yarn | 1.21.0 | |||
| Application | Yarnpkg | Yarn | 1.20.0 | |||
| Application | Yarnpkg | Yarn | 1.2.1 | |||
| Application | Yarnpkg | Yarn | 1.2.0 |