CVE-2019-10773: OS Command Injection
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2019-10773.
What is the severity of CVE-2019-10773?
The severity of CVE-2019-10773 is high (7.8).
What is the affected software version?
The affected software version is Yarn before 1.21.1.
How can the package install functionality be abused?
The package install functionality can be abused to generate arbitrary symlinks on the host filesystem.
Are existing files at risk of being overwritten?
Yes, existing files could be overwritten depending on the current user permission set.
How can I fix CVE-2019-10773?
To fix CVE-2019-10773, update Yarn to version 1.21.1 or later.
Where can I find more information about CVE-2019-10773?
You can find more information about CVE-2019-10773 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-10773), [GitHub Issue](https://github.com/yarnpkg/yarn/issues/7761#issuecomment-565493023), [GitHub Pull Request](https://github.com/yarnpkg/yarn/pull/7755).