Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

yarnpkg/berry

              master @ 352c4d6
            

Fixes

CVEs

HIGH

Peak severity

9.1%

Coverage

Highlights

Path Traversal: 3 prior fixes. Scrutinize any change in this area.

@yarnpkg/plugin-npm: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: Attackers can trigger remote code execution by forcing the client to clone and execute pack/setup scripts from untrusted git repositories. The mitigation restricts clones to an approved git repositories configuration pattern.

Remote Code Execution: The 'exec:' protocol allows the execution of arbitrary local scripts during yarn install operations. This is mitigated by explicitly validating execution against the 'enableScripts' configuration flag.

Code Execution: Running commands like `yarn link` can trigger arbitrary local execution of malicious configurations or plugins if local rc configuration loading is not explicitly disabled.