CVE-2020-8131

Name	CVE-2020-8131
Description	Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium
Debian Bugs	952912

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-yarnpkg (PTS)	buster	1.13.0-1+deb10u1	vulnerable
	bullseye	1.19.1-1	vulnerable
	sid	1.21.1-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-yarnpkg	source	(unstable)	(unfixed)			952912
node-yarnpkg	source	experimental	1.22.4-1

https://hackerone.com/reports/730239
https://github.com/yarnpkg/yarn/pull/7831