Is CVE-2021-4435 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-4435 being exploited in the wild.

How severe is CVE-2021-4435?

Low severity, with a CVSS score of 3.1, published 4 February 2024.

Which products and versions are affected?

yarn (npm) SEMVER:introduced=0,fixed=1.22.13.

Is there a fix for CVE-2021-4435?

Yes. yarn (npm): upgrade to 1.22.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-4435 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2021-4435?

Check whether you run yarn (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-4435: Yarn untrusted search path vulnerability

CVE-2021-4435 · Severity: low · CVSS 3.1 · Published 2024-02-04

Yarn is a popular package manager for JavaScript projects. An attacker who places malicious content in a directory where a user runs Yarn commands could trick Yarn into executing unintended commands, potentially compromising the user's system and allowing unauthorized access or modification of the project.

Technologies: yarn (npm). Vendors: npm.

Quick answers

Is CVE-2021-4435 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-4435 being exploited in the wild.
How severe is CVE-2021-4435?: Low severity, with a CVSS score of 3.1, published 4 February 2024.
Which products and versions are affected?: yarn (npm) SEMVER:introduced=0,fixed=1.22.13.
Is there a fix for CVE-2021-4435?: Yes. yarn (npm): upgrade to 1.22.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-4435 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2021-4435?: Check whether you run yarn (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

yarn (npm): upgrade to 1.22.13 or later
```
npm install yarn@1.22.13
```

Technical details

This is an untrusted search path vulnerability (CWE-426) in Yarn's command execution logic. When Yarn resolves executables, it includes the current working directory in its search path, allowing an attacker to place a malicious script there that gets executed instead of the intended binary. The vulnerability affects all versions before 1.22.13. An attacker must have write access to a directory where a user runs Yarn commands (local attack vector, requires user interaction to run the vulnerable commands). A successful exploit could result in arbitrary code execution with the privileges of the user running Yarn. The fix prevents the current working directory from being a valid resolution path for executable lookups.

Affected products

Yarn Yarn all versions before 1.22.13

Identifiers

CVE-2021-4435
GHSA-mpwj-fcr6-x34c

Timeline

2024-02-04: disclosed
2024-02-04: patched: Fixed in version 1.22.13

References

https://github.com/yarnpkg/yarn/commit/67fcce88935e45092ffa2674c08053f1ef5268a1

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.