CVE-2019-10773: yarn - Arbitrary Symlink Generation Vulnerability
Summary
CVE-2019-10773: In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Affects node-yarnpkg across 2 version ranges.
< 1.21.1-1
< 039bafd74b7b1a88a53a54f8fa6fa872615e90e7
Fixed in 1.21.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yarn is a popular package manager for JavaScript that provides a fast, reliable, and secure way to manage dependencies. It is widely used in the Node.js ecosystem for managing packages and their versions. However, Yarn versions before 1.21.1 are vulnerable to an arbitrary symlink generation issue.
Vulnerability Detail
The vulnerability (CVE-2019-10773) in Yarn allows an attacker to abuse the package install functionality to create arbitrary symlinks on the host filesystem. By using specially crafted 'bin' keys, an attacker can overwrite existing files depending on the current user's permission set. This can lead to unauthorized access, data loss, or even remote code execution.
How To Fix
Minimum fixed version
1.21.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-yarnpkgTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Yarn is not immediately possible, a temporary workaround is to avoid installing packages from untrusted sources. Additionally, it is recommended to review and validate the 'bin' keys in the package.json file before installing any packages.
Conclusion
The vulnerability in Yarn (CVE-2019-10773) allows an attacker to generate arbitrary symlinks on the host filesystem, potentially leading to unauthorized access or remote code execution. It is crucial to update Yarn to version 1.22.0 or later to fix this vulnerability. If you need further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-yarnpkg →
FAQ
Yarn is a package manager for JavaScript that provides a reliable and secure way to manage dependencies in the Node.js ecosystem.
The vulnerability occurs due to a design flaw in Yarn's package install functionality, which allows the generation of arbitrary symlinks on the host filesystem.
The vulnerability can lead to unauthorized access, data loss, or remote code execution, as it allows an attacker to overwrite existing files on the host filesystem.
Yes, updating Yarn to version 1.22.0 or later fixes this vulnerability by preventing the abuse of the package install functionality.
A temporary workaround is to avoid installing packages from untrusted sources and to review the 'bin' keys in the package.json file before installation.
Related vulnerabilities
Recent vulnerabilities recorded for node-yarnpkg.
