description: The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.
problem types: Business Logic Errors (CWE-840)
affected:
{
product: yarn
vendor: n/a
versions:
status: affected, version: Fixed in 1.19.0
}