description: Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.
problem types: Missing Encryption of Sensitive Data (CWE-311)
affected:
{
product: yarn
vendor: yarn
versions:
status: affected, version: Fixed in 1.17.3
}