Описание
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
A flaw was found in Yarn in versions prior to 1.21.1. Arbitrary symlinks can be generated using the package install functionality leading to existing files being overwritten. The highest threat from this vulnerability is to system confidentiality and integrity as well as system availability.
Дополнительная информация
Статус:
7.8 High
CVSS3
Связанные уязвимости
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
In Yarn before 1.21.1, the package install functionality can be abused ...
Yarn Improper link resolution before file access (Link Following)
7.8 High
CVSS3