title: Yarn: untrusted search path
description: An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
problem types: Untrusted Search Path
affected:
{
product: yarn
vendor: n/a
versions:
version: 1.22.13, status: unaffected
}
{
product: Fedora
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: yarnpkg
defaultStatus: unaffected
}
{
product: Extra Packages for Enterprise Linux
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: yarnpkg
defaultStatus: unaffected
}
metrics:
other: [
content: {'value': 'Moderate', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]