CVE-2020-8131

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-02-24 · updated 2026-06-17
Weakness: CWE-22

Description

Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

Affected products

yarn: through 1.21.1

References

https://github.com/yarnpkg/yarn/pull/7831
https://hackerone.com/reports/730239
https://github.com/yarnpkg/yarn/pull/7831
https://hackerone.com/reports/730239

Get alerted when CVE-2020-8131 or the next vulnerability affects your stack