VULNERABILITY INTELLIGENCE

CVE-2019-5448

CVSS score8.1 HIGH

EPSS probability0.67%

CISA KEVNot currently listed

Published2019-07-30

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

Weakness classification

CWE-311: Missing Encryption of Sensitive Data
CWE-319: Cleartext Transmission of Sensitive Information

Primary references

support@hackerone.com — Exploit, Third Party Advisory
support@hackerone.com — Permissions Required, Third Party Advisory
support@hackerone.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Permissions Required, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory