PT-2025-31053 · Unknown+1 · Yarnpkg Yarn+1

Mmmsssttt · Published 2025-07-28 · Updated 2025-07-31 · CVE-2025-8262

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions yarnpkg Yarn versions up to 1.22.22

Description A vulnerability exists in the explodeHostedGitFragment function within the src/resolvers/exotics/hosted-git-resolver.js file. This manipulation results in inefficient regular expression complexity, potentially allowing for remote exploitation.

Recommendations Apply the patch identified as 97731871e674bf93bcbf29e9d3258da8685f3076 to resolve this issue.

Exploit

Fix

Resource Exhaustion

DoS

Weakness Enumeration

CWE-400

CWE-1333

Related Identifiers

CVE-2025-8262

Affected Products

Debian

Yarnpkg Yarn

References · 18

• 🔥 https://github.com/yarnpkg/yarn/pull/9199 · Exploit
• https://github.com/yarnpkg/yarn/pull/9199/commits/97731871e674bf93bcbf29e9d3258da8685f3076 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-8262 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-8262 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-8262 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-8262 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-8262 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8262 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8262 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-8262 · Vendor Advisory
• https://vuldb.com/?id.317850 · Note
• https://docs.bell-sw.com/security/cves/CVE-2025-8262 · Note
• https://twitter.com/VulmonFeeds/status/1949734442706079896 · Twitter Post
• https://vuldb.com/?submit.617393 · Note
• https://t.me/CVEtracker/28543 · Telegram Post