CVE-2019-10773

PoC ×2—

CVSS 3.1

7.8 high

EPSS

2%p73

Published

Dec 16, 2019 (Dec 16, 2019)

Modified

Jun 17, 2026

Description

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.

Vendors: yarnpkg
Products: yarn
Weakness: CWE-59
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.5%)

In the news0 stories

No ingested article mentions this CVE yet.