CVE-2025-9308

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation leads to inefficient regular expression complexity. Local access is required to approach this attack. This vulnerability only affects products that are no longer supported by the maintainer.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-1333

Affected software

Vendor	Product	Versions
yarnpkg	Yarn	1.22.0; 1.22.1; 1.22.2; 1.22.3; 1.22.4; 1.22.5; 1.22.6; 1.22.7; 1.22.8; 1.22.9; 1.22.10; 1.22.11; 1.22.12; 1.22.13; 1.22.14; 1.22.15; 1.22.16; 1.22.17; 1.22.18; 1.22.19

References

https://github.com/yarnpkg/yarn/pull/9203Exploit, Issue Tracking
https://vuldb.com/?ctiid.320913Permissions Required, VDB Entry
https://vuldb.com/?id.320913Third Party Advisory, VDB Entry
https://vuldb.com/?submit.633486Third Party Advisory, VDB Entry
https://github.com/yarnpkg/yarn/pull/9203Exploit, Issue Tracking

Timeline

Published: Aug 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-93097.0A vulnerability was found in Tenda AC10 16.03.10.13. Affected is an unknown function of the file /etc_ro/shadow of the component MD5 Hash Ha CVE-2025-93107.5A vulnerability was determined in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. Affected by this vulnerability is an unkn CVE-2025-93119.8A vulnerability was identified in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the CVE-2025-93129.8A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services CVE-2025-93139.3An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the data CVE-2025-93149.8The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload CVE-2025-93156.3An unauthenticated device registration vulnerability, caused by Improperly Controlled Modification of Dynamically-Determined Object Attribut CVE-2025-93166.9N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.CVE-2025-93178.4The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse eng CVE-2025-93186.5The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘is_lin CVE-2025-93197.5A potential vulnerability was reported in the Lenovo Wallpaper Client that could allow arbitrary code execution under certain conditions.CVE-2025-93219.8The WPCasa plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.4.1. This is due to insufficient inp