CVE-2020-8131: Path Traversal in Yarn
Summary
CVE-2020-8131: Path Traversal in Yarn. Affects yarn versions < 1.22.0. Fixed in 1.22.0. How to fix ↓
Also tracked for
- node-yarnpkg · Debian:11
The same CVE-2020-8131 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yarn is a popular package manager for the npm ecosystem. It is used to manage dependencies and install packages for JavaScript projects. Yarn allows users to efficiently download and manage packages from the npm registry. However, versions 1.21.1 and earlier of Yarn are vulnerable to a path traversal attack, which can lead to arbitrary code execution. This vulnerability allows attackers to write to any path on the filesystem by forcing the user to install a malicious package.
Vulnerability Detail
The path traversal vulnerability in Yarn allows an attacker to write to any path on the filesystem. By exploiting this vulnerability, an attacker can potentially execute arbitrary code on the system. This can lead to a variety of malicious activities, such as unauthorized access, data manipulation, or even complete system compromise. The vulnerability is rated as HIGH severity with a CVSS score of 7.5.
How To Fix
Latest published version: 1.22.22 as of 22 Oct 2026
npm install yarn@1.22.22Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.22.0
This is the first release that contains the fix.
npm install yarn@1.22.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update Yarn to the latest version to mitigate the risk of exploitation.
Conclusion
The path traversal vulnerability in Yarn can have serious consequences, including arbitrary code execution and system compromise. It is crucial to update Yarn to the latest version (1.22.0 or later) to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yarn →
FAQ
Yarn is a package manager for the npm ecosystem, used to manage dependencies and install packages for JavaScript projects.
A path traversal vulnerability allows an attacker to access files or directories outside of the intended directory structure. In this case, the vulnerability in Yarn allows an attacker to write to any path on the filesystem.
The path traversal vulnerability in Yarn can lead to arbitrary code execution, which can result in unauthorized access, data manipulation, or complete system compromise.
This vulnerability is rated as HIGH severity with a CVSS score of 7.5.
To fix this vulnerability, it is recommended to upgrade Yarn to version 1.22.0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for yarn.
