{"id":"CVE-2019-10773","aliases":["BELL-CVE-2019-10773","CLSA-2026-1786378841","CLSA-2026-1786471987","DEBIAN-CVE-2019-10773","EUVD-2020-0291","GHSA-5xf4-f2fq-f69j","ROOT-APP-NPM-CVE-2019-10773","UBUNTU-CVE-2019-10773"],"status":"published","title":"Yarn Improper link resolution before file access (Link Following)","description":"In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted \"bin\" keys. Existing files could be overwritten depending on the current user permission set.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01518,"percentile":0.74739,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59","CWE-78"],"published":"2019-12-16T19:31:34Z","modified":"2026-10-20T10:50:38Z","fixes":[{"ecosystem":"npm","package":"yarn","fixed_in":["1.22.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"node-yarnpkg","fixed_in":["1.21.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-yarnpkg","fixed_in":["1.21.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-yarnpkg","fixed_in":["1.21.1-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"yarn","fixed_in":["1.21.1-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/yarn","fixed_in":["1.21.1-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"yarn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.21.1"},{"fixed":"1.22.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"yarn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.2-tuxcare.0"},{"fixed":"1.15.2-tuxcare.1"}]}],"versions":["1.15.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"yarn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.21.0-tuxcare.0"},{"fixed":"1.21.0-tuxcare.1"}]}],"versions":["1.21.0"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"node-yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-1"}]}]},{"source":"osv","ecosystem":"npm","package":"yarn","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.22.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"yarn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/yarn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.0-1build1","1.13.0-3","1.19.1-1","1.22.4-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.10+~cs22.25.14-3","1.22.10+~cs22.25.14-4","1.22.10+~cs22.25.14-5","1.22.10+~cs22.25.14-8"]}],"products":[{"vendor":"yarnpkg","product":"yarn"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-YARN-537806%2C","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"https://github.com/yarnpkg/yarn/commit/039bafd74b7b1a88a53a54f8fa6fa872615e90e7","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/yarnpkg/yarn/issues/7761#issuecomment-565493023","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITY5BC63CCC647DFNUQRQ5AJDKUKUNBI/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HIZW4NZVV5QY5WWGW2JRP3FHYKZ6ZJ5/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0475","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10773","tags":["advisory"]},{"url":"https://github.com/yarnpkg/yarn/pull/7755","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HIZW4NZVV5QY5WWGW2JRP3FHYKZ6ZJ5/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITY5BC63CCC647DFNUQRQ5AJDKUKUNBI/"},{"url":"https://snyk.io/vuln/SNYK-JS-YARN-537806,","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-5xf4-f2fq-f69j"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-10773","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-10773","tags":["advisory"]},{"url":"https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HIZW4NZVV5QY5WWGW2JRP3FHYKZ6ZJ5","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITY5BC63CCC647DFNUQRQ5AJDKUKUNBI","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-10773","tags":["report"]},{"url":"https://snyk.io/vuln/SNYK-JS-YARN-537806","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10773","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-10773","description":"In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted \"bin\" keys. Existing files could be overwritten depending on the current user permission set.","status":"published","published":"2019-12-16T19:31:34Z","modified":"2024-08-04T22:32:01.551Z","updated_at":"2026-11-02T14:20:19.399352Z"}],"euvd":[{"id":"EUVD-2020-0291","description":"In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted \"bin\" keys. Existing files could be overwritten depending on the current user permission set.","status":"published","published":"2019-12-16T19:31:34Z","modified":"2024-08-04T22:32:01Z","updated_at":"2026-11-03T02:40:51.198112Z"}],"ghsa":[{"id":"GHSA-5xf4-f2fq-f69j","title":"Yarn Improper link resolution before file access (Link Following)","description":"In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted \"bin\" keys. Existing files could be overwritten depending on the current user permission set.","status":"published","published":"2020-02-14T23:10:16Z","modified":"2023-09-08T22:40:49Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:37:03.916765Z"}],"nvd":[{"id":"CVE-2019-10773","description":"In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted \"bin\" keys. Existing files could be overwritten depending on the current user permission set.","status":"published","published":"2019-12-16T20:15:14.477Z","modified":"2026-06-17T02:11:38.71Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:05:40.258829Z"}],"osv":[{"id":"BELL-CVE-2019-10773","title":"CVE-2019-10773 does not affect BellSoft software","status":"withdrawn","published":"2019-12-16T20:15:00Z","modified":"2026-02-14T07:59:38.094837Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2019-10773","description":"In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted \"bin\" keys. Existing files could be overwritten depending on the current user permission set.","status":"published","published":"2019-12-16T20:15:14.477Z","modified":"2026-10-20T10:50:38.350336341Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"DEBIAN-CVE-2019-10773","description":"In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted \"bin\" keys. Existing files could be overwritten depending on the current user permission set.","status":"published","published":"2019-12-16T20:15:14.477Z","modified":"2026-09-21T07:00:36.298540924Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"GHSA-5xf4-f2fq-f69j","title":"Yarn Improper link resolution before file access (Link Following)","description":"In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted \"bin\" keys. Existing files could be overwritten depending on the current user permission set.","status":"published","published":"2020-02-14T23:10:16Z","modified":"2026-09-10T03:49:25.201779354Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"UBUNTU-CVE-2019-10773","description":"In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted \"bin\" keys. Existing files could be overwritten depending on the current user permission set.","status":"published","published":"2019-12-16T20:15:00Z","modified":"2025-10-24T04:47:36Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"CLSA-2026-1786378841","title":"TuxCare security update for yarn (5 CVEs)","description":"TuxCare rebuilt yarn to address 5 CVEs. Fixed in 1.15.2-tuxcare.1.","status":"published","published":"2026-08-10T16:20:41Z","modified":"2026-10-15T09:46:00.652464848Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1786471987","title":"TuxCare security update for yarn (3 CVEs)","description":"TuxCare rebuilt yarn to address 3 CVEs. Fixed in 1.21.0-tuxcare.1.","status":"published","published":"2026-08-11T18:13:07Z","modified":"2026-10-15T09:45:59.896663024Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"ROOT-APP-NPM-CVE-2019-10773","title":"CVE-2019-10773 in yarn - Patched by Root","description":"Root has patched CVE-2019-10773 in the yarn package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-07T11:20:08Z","modified":"2026-10-07T12:15:03.538094383Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}