CVE-2021-4435

An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2021-4435	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2262284	Issue Tracking
https://github.com/yarnpkg/yarn/commit/67fcce88935e45092ffa2674c08053f1ef5268a1	Patch
https://github.com/yarnpkg/yarn/releases/tag/v1.22.13	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:yarnpkg:yarn:*:*:*:*:*:*:*:*

History

13 Feb 2024, 00:38

Type	Values Removed	Values Added
First Time		Yarnpkg yarn Yarnpkg
CPE		cpe:2.3:a:yarnpkg:yarn::::::::
References	~~() https://access.redhat.com/security/cve/CVE-2021-4435 -~~	() https://access.redhat.com/security/cve/CVE-2021-4435 - Third Party Advisory
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=2262284 -~~	() https://bugzilla.redhat.com/show_bug.cgi?id=2262284 - Issue Tracking
References	~~() https://github.com/yarnpkg/yarn/commit/67fcce88935e45092ffa2674c08053f1ef5268a1 -~~	() https://github.com/yarnpkg/yarn/commit/67fcce88935e45092ffa2674c08053f1ef5268a1 - Patch
References	~~() https://github.com/yarnpkg/yarn/releases/tag/v1.22.13 -~~	() https://github.com/yarnpkg/yarn/releases/tag/v1.22.13 - Release Notes
CVSS	v2 : ~~unknown~~ v3 : ~~7.7~~	v2 : unknown v3 : 7.8

04 Feb 2024, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-02-04 20:15

Updated : 2024-02-13 00:38

NVD link : CVE-2021-4435

Mitre link : CVE-2021-4435

CVE.ORG link : CVE-2021-4435

JSON object : View

Products Affected

yarnpkg

yarn

CWE

CWE-426

Untrusted Search Path

{"id": "CVE-2021-4435", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "patrick@puiterwijk.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.0}]}, "published": "2024-02-04T20:15:45.657", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2021-4435", "tags": ["Third Party Advisory"], "source": "patrick@puiterwijk.org"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262284", "tags": ["Issue Tracking"], "source": "patrick@puiterwijk.org"}, {"url": "https://github.com/yarnpkg/yarn/commit/67fcce88935e45092ffa2674c08053f1ef5268a1", "tags": ["Patch"], "source": "patrick@puiterwijk.org"}, {"url": "https://github.com/yarnpkg/yarn/releases/tag/v1.22.13", "tags": ["Release Notes"], "source": "patrick@puiterwijk.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-426"}]}, {"type": "Secondary", "source": "patrick@puiterwijk.org", "description": [{"lang": "en", "value": "CWE-426"}]}], "descriptions": [{"lang": "en", "value": "An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad de ruta de b\u00fasqueda no confiable en Yarn. Cuando una v\u00edctima ejecuta ciertos comandos de Yarn en un directorio con contenido controlado por un atacante, se podr\u00edan ejecutar comandos maliciosos de formas inesperadas."}], "lastModified": "2024-02-13T00:38:56.303", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:yarnpkg:yarn:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BCBACDE9-403C-4A92-8F39-ABCF4216F7AA", "versionEndExcluding": "1.22.13"}], "operator": "OR"}]}], "sourceIdentifier": "patrick@puiterwijk.org"}