Executive brief
Yarn is a popular package manager for JavaScript projects. An attacker who places malicious content in a directory where a user runs Yarn commands could trick Yarn into executing unintended commands, potentially compromising the user's system and allowing unauthorized access or modification of the project.
Technical details
This is an untrusted search path vulnerability (CWE-426) in Yarn's command execution logic. When Yarn resolves executables, it includes the current working directory in its search path, allowing an attacker to place a malicious script there that gets executed instead of the intended binary. The vulnerability affects all versions before 1.22.13. An attacker must have write access to a directory where a user runs Yarn commands (local attack vector, requires user interaction to run the vulnerable commands). A successful exploit could result in arbitrary code execution with the privileges of the user running Yarn. The fix prevents the current working directory from being a valid resolution path for executable lookups.
Affected products
- Yarn Yarn all versions before 1.22.13
Timeline
- 2024-02-04: disclosed
- 2024-02-04: patched: Fixed in version 1.22.13