CVE-2019-10773

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
n/a	Yarn	All versions prior to version 1.21.1

References

Timeline

Published: Dec 16, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-107749.8php-shellcommand versions before 1.6.1 have a command injection vulnerability. Successful exploitation could lead to arbitrary code executio CVE-2019-107757.5ecstatic have a denial of service vulnerability. Successful exploitation could lead to crash of an application.CVE-2019-107769.8In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-dif CVE-2019-107779.8In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function wi CVE-2019-107789.8devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The var CVE-2019-107796.1All versions of stroom:stroom-app before 5.5.12 and all versions of the 6.0.0 branch before 6.0.25 are affected by Cross-site Scripting. An CVE-2019-10785.5An information disclosure vulnerability exists when the Windows Graphics component improperly handles objects in memory. An attacker who suc CVE-2019-107809.8BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open CVE-2019-107819.8In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used wit CVE-2019-107825.3All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix f CVE-2019-107839.8All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec CVE-2019-107849.6phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One