CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2020-8131
High (7.5) in yarnpkg yarn. EPSS 5.2% chance of exploitation in the next 30 days. Fixed in yarn 1.22.0.
Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
Severity
- EPSS
- 5.2% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- yarnpkg:yarn
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8mfc-v7wv-p62g | npm | yarn | <1.22.0 | 1.22.0 |