CVE-2019-10773 Yarn Improper link resolution before file access (Link Following)

What is CVE-2019-10773?

CVE-2019-10773 is a high-severity path traversal vulnerability in Yarn, published on 16 Dec 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.

Weakness: CWE-59

Which versions are affected by CVE-2019-10773?

2 open source packages ship an affected version, including yarn. It affects 1 product.

Products include Yarnpkg Yarn.

How do I fix CVE-2019-10773?

Upgrade yarn to 1.22.0 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2019-10773 being exploited?

There is no known exploitation of CVE-2019-10773 in the wild and no public exploit code.

Other vulnerabilities in Yarn

• CVE-2019-5448 Missing Encryption of Sensitive Data in yarn High 8.1
• CVE-2021-4435 Yarn: untrusted search path High 7.7
• CVE-2020-8131 Path Traversal in Yarn High 7.5
• CVE-2019-15608 TOCTOU Race Condition in Yarn Medium 5.9
• CVE-2025-8262 yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-10773, GHSA-5xf4-f2fq-f69j, ROOT-APP-NPM-CVE-2019-10773, SNYK-JS-YARN-537806,, UBUNTU-CVE-2019-10773.