PT-2024-11033 · Yarn+2 · Yarn+2

Ybuenos · Published 2024-02-04 · Updated 2025-02-28 · CVE-2021-4435

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yarn (affected versions not specified)

Description An untrusted search path issue was found, allowing malicious commands to be executed in unexpected ways when certain commands are run in a directory with attacker-controlled content.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

ALT-PU-2025-3548

CVE-2021-4435

GHSA-MPWJ-FCR6-X34C

Affected Products

Alt Linux

Debian

Yarn

References · 14

• https://github.com/yarnpkg/yarn/commit/67fcce88935e45092ffa2674c08053f1ef5268a1 · Patch
• https://cve.org/CVERecord?id=CVE-2021-4435 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-4435 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-4435 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mpwj-fcr6-x34c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4435 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4435 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-4435 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-4435 · Vendor Advisory
• https://github.com/yarnpkg/yarn/releases/tag/v1.22.13 · Note
• https://github.com/yarnpkg/yarn · Note
• https://access.redhat.com/security/cve/CVE-2021-4435 · Note
• https://twitter.com/CVEnew/status/1754227682852630532 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2262284 · Note