CVE-2019-15608: TOCTOU Race Condition in Yarn
Summary
CVE-2019-15608: TOCTOU Race Condition in Yarn. Affects yarn versions < 1.19.0. Fixed in 1.19.0. How to fix ↓
Also tracked for
- node-yarnpkg · Debian:11
The same CVE-2019-15608 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yarn is a package manager for the npm ecosystem. It is used to manage dependencies and ensure consistent installations of packages. Yarn calculates a hash of a package before writing it to the cache. However, in versions prior to 1.19.0, the hash is not recomputed when reading from the cache. This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability, which can be exploited for cache pollution attacks.
Vulnerability Detail
The TOCTOU vulnerability in Yarn allows an attacker to manipulate the package cache by replacing a package with a malicious one after the hash has been computed. When Yarn reads from the cache, it does not recompute the hash, leading to the execution of potentially malicious code. This can result in various security issues, such as code injection or privilege escalation. The vulnerability has a CVSS score of 5.9.
How To Fix
Latest published version: 1.22.22 as of 22 Oct 2026
npm install yarn@1.22.22Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.19.0
This is the first release that contains the fix.
npm install yarn@1.19.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Yarn to the fixed version.
Conclusion
The TOCTOU race condition vulnerability in Yarn can be exploited to manipulate the package cache and execute potentially malicious code. It is recommended to update Yarn to version 1.19.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for yarn →
FAQ
Yarn is a package manager for the npm ecosystem. It helps manage dependencies and ensures consistent installations of packages.
A Time-of-Check to Time-of-Use (TOCTOU) race condition occurs when a condition is checked at one point in time but can change before it is used. In this case, the hash of a package is computed before writing to the cache but not recomputed when reading from the cache.
This vulnerability can lead to cache pollution attacks, where an attacker replaces a legitimate package with a malicious one. This can result in code injection, privilege escalation, or other security issues.
To fix this vulnerability, update Yarn to version 1.19.0 or later. This version includes a fix for the TOCTOU race condition.
No, there is no known workaround for this vulnerability. It is crucial to update Yarn to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for yarn.
