GHSA-mpwj-fcr6-x34c

    Dashboard / Vulnerabilities / GHSA-mpwj-fcr6-x34c

    GHSA-mpwj-fcr6-x34c

    Published: 4 Feb 2024Last Modified: 10 Sept 2026
    Aliases:
    CVE-2021-4435

    Summary: Yarn untrusted search path vulnerability

    Details: An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.

    References: https://nvd.nist.gov/vuln/detail/CVE-2021-4435, https://github.com/yarnpkg/yarn/commit/67fcce88935e45092ffa2674c08053f1ef5268a1, https://access.redhat.com/security/cve/CVE-2021-4435, https://bugzilla.redhat.com/show_bug.cgi?id=2262284, https://github.com/yarnpkg/yarn, https://github.com/yarnpkg/yarn/releases/tag/v1.22.13

    Affected packages

    Package

    Name: yarn

    Purl: pkg:npm/yarn

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.22.13

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-mpwj-fcr6-x34c | CVE-DB