CVE-2020-8131
Path Traversal in Yarn
Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
- Record
CVE-2020-8131- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
- Record
CVE-2020-8131- Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2022-0922 No score
Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
- Record
EUVD-2022-0922- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8mfc-v7wv-p62g
Path Traversal in Yarn
Arbitrary filesystem write vulnerability in Yarn 1.21.1 and earlier allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
- Record
GHSA-8mfc-v7wv-p62g- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
- Record
CVE-2020-8131- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-8131
Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
- Record
DEBIAN-CVE-2020-8131- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-8mfc-v7wv-p62g
Path Traversal in Yarn
Arbitrary filesystem write vulnerability in Yarn 1.21.1 and earlier allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
- Record
GHSA-8mfc-v7wv-p62g- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-8131
Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
- Record
UBUNTU-CVE-2020-8131- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1786378841 No score
TuxCare security update for yarn (5 CVEs)
TuxCare rebuilt yarn to address 5 CVEs. Fixed in 1.15.2-tuxcare.1.
- Record
CLSA-2026-1786378841- Updated
- 2026-11-02
OSVCLSA-2026-1786471987 No score
TuxCare security update for yarn (3 CVEs)
TuxCare rebuilt yarn to address 3 CVEs. Fixed in 1.21.0-tuxcare.1.
- Record
CLSA-2026-1786471987- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2020-8131 No score
CVE-2020-8131 in yarn - Patched by Root
Root has patched CVE-2020-8131 in the yarn package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2020-8131- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
yarnnpm |
through 1.21.1 | 1.22.0 |
yarnTuxCare:npm From an advisory covering 5 CVEs |
1.15.2-tuxcare.0 up to 1.15.2-tuxcare.1, plus listed versions 1.15.2 |
1.15.2-tuxcare.1 |
yarnTuxCare:npm From an advisory covering 3 CVEs |
1.21.0-tuxcare.0 up to 1.21.0-tuxcare.1, plus listed versions 1.21.0 |
1.21.0-tuxcare.1 |
node-yarnpkgDebian:12 |
before 1.22.4-2 | 1.22.4-2 |
node-yarnpkgDebian:13 |
before 1.22.4-2 | 1.22.4-2 |
node-yarnpkgDebian:14 |
before 1.22.4-2 | 1.22.4-2 |
yarnnpm |
before 1.22.0 | 1.22.0 |
yarnRoot:npm |
before 1.21.1-aikido.1 | 1.21.1-aikido.1 |
@rootio/yarnRoot:npm |
before 1.21.1-root.io.1 | 1.21.1-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-8131 is a high vulnerability (CVSS 7.5) in Yarnpkg Yarn, published February 24, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.16%, the 92nd percentile. Fixed in yarn 1.22.0.