In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted “bin” keys. Existing files could be overwritten depending on the current user permission set.
access.redhat.com/errata/RHSA-2020:0475
blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn
github.com/yarnpkg/yarn/commit/039bafd74b7b1a88a53a54f8fa6fa872615e90e7
github.com/yarnpkg/yarn/issues/7761#issuecomment-565493023
github.com/yarnpkg/yarn/pull/7755
lists.fedoraproject.org/archives/list/[email protected]/message/3HIZW4NZVV5QY5WWGW2JRP3FHYKZ6ZJ5
lists.fedoraproject.org/archives/list/[email protected]/message/ITY5BC63CCC647DFNUQRQ5AJDKUKUNBI
nvd.nist.gov/vuln/detail/CVE-2019-10773
snyk.io/vuln/SNYK-JS-YARN-537806,