Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

yarnpkg/yarn

              master @ c2dda50
            

Fixes

CVEs

HIGH

Peak severity

42.1%

Coverage

Highlights

Path Traversal: 6 prior fixes. Scrutinize any change in this area.

src/fetchers/tarball-fetcher.js: most-fixed (4 issues). Treat as high-risk during review.

9 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Tarball extraction has historically been vulnerable to directory traversal via linknames or path resolve failures during unpack. This can lead to arbitrary file writes during package installation. Use of safe libraries like tar-fs and strict jail prefix checks are critical.

Command Injection: Execution of package scripts and lifecycle hooks is prone to command injection and argument splitting, especially on Windows, if arguments and variables are not thoroughly escaped or quoted before execution.

Path Traversal: Malicious dependency manifests containing manipulated or empty bin symlink targets can overwrite arbitrary host files or create unwanted root directory symlinks during package installation.