CVE-2021-4435 Yarn: untrusted search path
Attackers can execute malicious commands when victims run Yarn in directories with attacker-controlled content due to untrusted search paths.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-4435?
CVE-2021-4435 is a high-severity path traversal vulnerability in Fedora Extra Packages for Enterprise Linux, published on 4 Feb 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
Weakness: CWE-426
Which versions are affected by CVE-2021-4435?
2 open source packages ship an affected version, including yarn. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yarn npm | All versions | 1.22.13 |
yarn npm | All versions | 1.22.13 |
Products include Yarnpkg Yarn.
How do I fix CVE-2021-4435?
Upgrade yarn to 1.22.13 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-4435 being exploited?
There is no known exploitation of CVE-2021-4435 in the wild and no public exploit code.
Other vulnerabilities in Fedora Extra Packages for Enterprise Linux
- CVE-2019-5448 Missing Encryption of Sensitive Data in yarn
- CVE-2019-10773 Yarn Improper link resolution before file access (Link Following)
- CVE-2020-8131 Path Traversal in Yarn
- CVE-2019-15608 TOCTOU Race Condition in Yarn
- CVE-2025-8262 yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos
Sources
Also known as CLSA-2026-1786471978, DEBIAN-CVE-2021-4435, GHSA-mpwj-fcr6-x34c, ROOT-APP-NPM-CVE-2021-4435, UBUNTU-CVE-2021-4435.