VULNERABILITY INTELLIGENCE

CVE-2019-10773

CVSS score7.8 HIGH
EPSS probability1.52%
CISA KEVNot currently listed
Published2019-12-16
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.

Weakness classification

  • CWE-59: Improper Link Resolution Before File Access ('Link Following')

Primary references