Quick answers
- Is CVE-2020-8131 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-8131 being exploited in the wild.
- How severe is CVE-2020-8131?
- Low severity, with a CVSS score of 3.1, published 9 February 2022.
- Which products and versions are affected?
- yarn (npm) SEMVER:introduced=0,fixed=1.22.0.
- Is there a fix for CVE-2020-8131?
- Yes. yarn (npm): upgrade to 1.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2020-8131 attacked?
- It is attacked over the network.
- Am I affected by CVE-2020-8131?
- Check whether you run yarn (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- yarn (npm): upgrade to 1.22.0 or later
npm install yarn@1.22.0
Technical details
The vulnerability is a path traversal (CWE-22) flaw in Yarn's file handling during package fetching and installation. An attacker can craft a malicious package that, when installed via yarn install, writes files outside the intended package directory by exploiting insufficient path validation. The attack requires user interaction (convincing a user to install the malicious package) but no authentication. Successful exploitation can lead to arbitrary file write on the filesystem and potentially arbitrary code execution, especially when postinstall scripts are enabled or when --ignore-scripts is not used. The vulnerability was patched in Yarn 1.22.0.
Affected products
- Yarn Yarn 1.21.1 and earlier
Identifiers
- CVE-2020-8131
- GHSA-8mfc-v7wv-p62g
Timeline
- 2020-02-24: disclosed: Published on NVD
- 2020-01-31: patched: Fix merged into Yarn master branch; released in version 1.22.0