CVE-2019-5448CWE-311

CVE-2019-5448: vulnerability in yarn

Published · Updated

Follow this CVE+ Monitor yarn+ Monitor node-yarnpkg

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.7%
Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.
Affected products
yarn · yarn