# CVE-2019-10773: Yarn improper link resolution allowing arbitrary symlink creation

Source: https://junglewise.ai/threats/cve-2019-10773-yarn-improper-link-resolution-allowing-arbitrary-symlink-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-02-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2019-10773 · Severity: low · CVSS 3.1 · Published 2020-02-14

Yarn, a popular Node.js package manager, contains a flaw in how it handles "bin" declarations during package installation. Attackers can craft malicious packages to create symbolic links pointing to arbitrary locations on the filesystem, potentially overwriting existing files. This could allow an attacker to replace legitimate binaries or critical system files with malicious versions during a routine package installation.

Technologies: [yarn (npm)](https://junglewise.ai/threats/technologies/yarn). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2019-10773 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-10773 being exploited in the wild.

**How severe is CVE-2019-10773?** Low severity, with a CVSS score of 3.1, published 14 February 2020.

**Which products and versions are affected?** yarn (npm) SEMVER:introduced=0,fixed=1.22.0.

**Is there a fix for CVE-2019-10773?** Yes. yarn (npm): upgrade to 1.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-10773 attacked?** It is attacked with local access.

**Am I affected by CVE-2019-10773?** Check whether you run yarn (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- yarn (npm): upgrade to 1.22.0 or later

  ```sh
  npm install yarn@1.22.0
  ```


## Technical details

This is a link-following / path traversal vulnerability (CWE-78) in Yarn's bin installation logic. During package installation, Yarn processes the "bin" field in package.json to create executable entry points. The vulnerability allows an attacker to specify absolute paths or path traversal sequences (e.g., "../../../target/file") in bin declarations, causing Yarn to create symlinks that escape the intended node_modules directory and point to arbitrary filesystem locations. Attack vector is local with no authentication or special privileges required, though user interaction (installing a malicious package) is necessary. An attacker can overwrite files writable by the installing user, potentially replacing legitimate binaries with trojanized versions. The fix, released in Yarn 1.22.0 and backported to 1.21.1, validates bin paths to ensure they remain within the package directory boundaries and rejects escape attempts with warnings.

## Affected products

- Yarn yarn before 1.22.0 (including 1.21.1 and earlier)

## Identifiers

- CVE-2019-10773
- GHSA-5xf4-f2fq-f69j

## Timeline

- 2019-12-12: disclosed: Coordinated vulnerability disclosure; vulnerability independently discovered by Daniel Ruf on 2019-10-21
- 2019-12-11: patched: Yarn v1.21.1 and 1.22.0 released with fix (PR #7755)
- 2020-02-14: other: Advisory published in GitHub advisory database

## References

- [https://github.com/yarnpkg/yarn/issues/7761](https://github.com/yarnpkg/yarn/issues/7761)
- [https://github.com/yarnpkg/yarn/pull/7755](https://github.com/yarnpkg/yarn/pull/7755)
- [https://github.com/yarnpkg/yarn/commit/039bafd74b7b1a88a53a54f8fa6fa872615e90e7](https://github.com/yarnpkg/yarn/commit/039bafd74b7b1a88a53a54f8fa6fa872615e90e7)
- [https://access.redhat.com/errata/RHSA-2020:0475](https://access.redhat.com/errata/RHSA-2020:0475)
- [https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn](https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn)
- [https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HIZW4NZVV5QY5WWGW2JRP3FHYKZ6ZJ5](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HIZW4NZVV5QY5WWGW2JRP3FHYKZ6ZJ5)

## Related threats

- [Yarn untrusted search path vulnerability](https://junglewise.ai/threats/cve-2021-4435-yarn-untrusted-search-path-vulnerability)
- [Yarn package integrity validation TOCTOU race condition](https://junglewise.ai/threats/cve-2019-15608-yarn-package-integrity-validation-toctou-race-condition)
- [Yarn path traversal vulnerability in package installation](https://junglewise.ai/threats/cve-2020-8131-yarn-path-traversal-vulnerability-in-package-installation)
- [Yarn missing encryption of sensitive data in lockfile](https://junglewise.ai/threats/cve-2019-5448-yarn-missing-encryption-of-sensitive-data-in-lockfile)