CVE-2021-4435
Yarn: untrusted search path
An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Yarn: untrusted search path
An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
- Record
CVE-2021-4435- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-426
- Updated
- 2026-11-02
EUVDEUVD-2024-0674
An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
- Record
EUVD-2024-0674- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mpwj-fcr6-x34c
Yarn untrusted search path vulnerability
An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
- Record
GHSA-mpwj-fcr6-x34c- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-426
- Updated
- 2026-11-02
NVD
An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
- Record
CVE-2021-4435- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-426
- Updated
- 2026-11-02
OSV
An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
- Record
CVE-2021-4435- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-4435
An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
- Record
DEBIAN-CVE-2021-4435- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-mpwj-fcr6-x34c
Yarn untrusted search path vulnerability
An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
- Record
GHSA-mpwj-fcr6-x34c- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-426
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-4435
An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
- Record
UBUNTU-CVE-2021-4435- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1786378841 No score
TuxCare security update for yarn (5 CVEs)
TuxCare rebuilt yarn to address 5 CVEs. Fixed in 1.15.2-tuxcare.1.
- Record
CLSA-2026-1786378841- Updated
- 2026-11-02
OSVCLSA-2026-1786471978 No score
TuxCare security update for yarn (1 CVE)
TuxCare rebuilt yarn to address 1 CVE. Fixed in 1.22.1-tuxcare.1.
- Record
CLSA-2026-1786471978- Updated
- 2026-11-02
OSVCLSA-2026-1786471987 No score
TuxCare security update for yarn (3 CVEs)
TuxCare rebuilt yarn to address 3 CVEs. Fixed in 1.21.0-tuxcare.1.
- Record
CLSA-2026-1786471987- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2021-4435 No score
CVE-2021-4435 in yarn - Patched by Root
Root has patched CVE-2021-4435 in the yarn package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2021-4435- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
yarnnpm |
before 1.22.13 | 1.22.13 |
yarnTuxCare:npm From an advisory covering 5 CVEs |
1.15.2-tuxcare.0 up to 1.15.2-tuxcare.1, plus listed versions 1.15.2 |
1.15.2-tuxcare.1 |
yarnTuxCare:npm |
1.22.1-tuxcare.0 up to 1.22.1-tuxcare.1, plus listed versions 1.22.1 |
1.22.1-tuxcare.1 |
yarnTuxCare:npm From an advisory covering 3 CVEs |
1.21.0-tuxcare.0 up to 1.21.0-tuxcare.1, plus listed versions 1.21.0 |
1.21.0-tuxcare.1 |
node-yarnpkgDebian:12 |
before 1.22.19+~cs24.27.18-1 | 1.22.19+~cs24.27.18-1 |
node-yarnpkgDebian:13 |
before 1.22.19+~cs24.27.18-1 | 1.22.19+~cs24.27.18-1 |
node-yarnpkgDebian:14 |
before 1.22.19+~cs24.27.18-1 | 1.22.19+~cs24.27.18-1 |
yarnRoot:npm |
before 1.21.1-aikido.1 | 1.21.1-aikido.1 |
@rootio/yarnRoot:npm |
before 1.21.1-root.io.1 | 1.21.1-root.io.1 |
node-yarnpkgUbuntu:20.04:LTS |
All versions, plus listed versions 1.13.0-1build11.13.0-31.19.1-11.22.4-2 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
node-yarnpkgUbuntu:22.04:LTS |
All versions, plus listed versions 1.22.10+~cs22.25.14-31.22.10+~cs22.25.14-41.22.10+~cs22.25.14-51.22.10+~cs22.25.14-8 |
None known |
node-yarnpkgUbuntu:24.04:LTS |
All versions, plus listed versions 1.22.19+~cs24.27.18-21.22.19+~cs24.27.18-4 |
None known |
node-yarnpkgUbuntu:25.10 |
All versions, plus listed versions 4.0.2+dfsg-34.1.0+dfsg-1 |
None known |
node-yarnpkgUbuntu:26.10 |
All versions, plus listed versions 4.1.0+dfsg-14.1.0+dfsg-6ubuntu24.1.0+dfsg-7ubuntu1 |
None known |
node-yarnpkgUbuntu:26.04:LTS |
All versions, plus listed versions 4.1.0+dfsg-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-4435 is a high vulnerability (CVSS 7.7) in Yarnpkg Yarn, published February 4, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in yarn 1.22.13.