Yarnpkg vulnerabilities

Products

• Yarn 7

Newest

• yarnpkg yarn yarnpkg Yarn request-manager.js setOptions redos CVE-2025-9308 Fix available 4.8 MediumAugust 21, 2025
• yarnpkg yarn yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos CVE-2025-8262 5.3 MediumJuly 28, 2025
• yarnpkg yarn, fedora extra packages for enterprise linux, fedora +2 more Yarn: untrusted search path CVE-2021-4435 Fix available 7.7 HighFebruary 4, 2024
• yarnpkg yarn TOCTOU Race Condition in Yarn CVE-2019-15608 Fix available 5.9 MediumMarch 15, 2020
• yarnpkg yarn Path Traversal in Yarn CVE-2020-8131 Fix available 7.5 HighFebruary 24, 2020
• yarnpkg yarn Yarn Improper link resolution before file access (Link Following) CVE-2019-10773 Fix available 7.8 HighDecember 16, 2019
• yarn Missing Encryption of Sensitive Data in yarn CVE-2019-5448 Fix available 8.1 HighJuly 30, 2019
• yarnpkg website The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only... CVE-2018-12556 5.9 MediumMay 16, 2019