CVE-2019-10773: Improper link resolution before file access in Yarn
Summary
CVE-2019-10773: Yarn Improper link resolution before file access (Link Following). Affects yarn versions < 1.22.0. Fixed in 1.22.0. How to fix ↓
Also tracked for
- node-yarnpkg · Debian:11
The same CVE-2019-10773 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yarn is a popular package manager for the npm ecosystem. It is used to manage dependencies and install packages in JavaScript projects. Yarn provides a command-line interface and a package.json file to define project dependencies and scripts. This vulnerability affects Yarn versions before 1.22.0.
Vulnerability Detail
The vulnerability, identified as CVE-2019-10773, is an improper link resolution before file access vulnerability. It allows an attacker to abuse the package install functionality in Yarn to create arbitrary symlinks on the host filesystem. By using specially crafted "bin" keys, an attacker can overwrite existing files on the system, depending on the permissions of the current user. This can lead to unauthorized access, data loss, or remote code execution.
How To Fix
Latest published version: 1.22.22 as of 22 Oct 2026
npm install yarn@1.22.22Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.22.0
This is the first release that contains the fix.
npm install yarn@1.22.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update Yarn to the fixed version as soon as possible.
Conclusion
In conclusion, the vulnerability CVE-2019-10773 in Yarn allows an attacker to create arbitrary symlinks on the host filesystem, potentially leading to unauthorized access, data loss, or remote code execution. It is crucial to update Yarn to version 1.22.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yarn →
FAQ
Yarn is a package manager for the npm ecosystem, used to manage dependencies and install packages in JavaScript projects.
This vulnerability allows an attacker to create arbitrary symlinks on the host filesystem and potentially overwrite existing files. It can lead to unauthorized access, data loss, or remote code execution.
To fix this vulnerability, update Yarn to version 1.22.0 or later by running the command: npm install -g yarn
There is no known workaround for this vulnerability. It is recommended to update Yarn to the fixed version.
You can find more information about this vulnerability in the GitHub Security Advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-5xf4-f2fq-f69j/GHSA-5xf4-f2fq-f69j.json
References
Related vulnerabilities
Recent vulnerabilities recorded for yarn.
