Junglewise Threat Intelligence

CVE-2019-10773: Yarn improper link resolution allowing arbitrary symlink creation

CVE-2019-10773 · Severity: low · CVSS 3.1 · Published 2020-02-14

Technologies: Yarn. Vendors: npm.

Executive brief

Yarn, a popular Node.js package manager, contains a flaw in how it handles "bin" declarations during package installation. Attackers can craft malicious packages to create symbolic links pointing to arbitrary locations on the filesystem, potentially overwriting existing files. This could allow an attacker to replace legitimate binaries or critical system files with malicious versions during a routine package installation.

Technical details

This is a link-following / path traversal vulnerability (CWE-78) in Yarn's bin installation logic. During package installation, Yarn processes the "bin" field in package.json to create executable entry points. The vulnerability allows an attacker to specify absolute paths or path traversal sequences (e.g., "../../../target/file") in bin declarations, causing Yarn to create symlinks that escape the intended node_modules directory and point to arbitrary filesystem locations. Attack vector is local with no authentication or special privileges required, though user interaction (installing a malicious package) is necessary. An attacker can overwrite files writable by the installing user, potentially replacing legitimate binaries with trojanized versions. The fix, released in Yarn 1.22.0 and backported to 1.21.1, validates bin paths to ensure they remain within the package directory boundaries and rejects escape attempts with warnings.

Affected products

  • Yarn yarn before 1.22.0 (including 1.21.1 and earlier)

Timeline

  • 2019-12-12: disclosed: Coordinated vulnerability disclosure; vulnerability independently discovered by Daniel Ruf on 2019-10-21
  • 2019-12-11: patched: Yarn v1.21.1 and 1.22.0 released with fix (PR #7755)
  • 2020-02-14: other: Advisory published in GitHub advisory database

References

Related threats