{"action":"Upgrade yarn to 1.22.0 or later.","affected":[{"fixed":"1.22.0","introduced":"0"}],"component":"yarn","cve_ids":["CVE-2019-10773"],"ecosystem":"npm","epss":0.01518,"exploited":false,"fixed_versions":["1.22.0"],"ghsa_id":"GHSA-5xf4-f2fq-f69j","id":"tcs_01M5KF50W6CYDACHZ994YQRP4N","modified_at":"2026-09-10T03:49:25.201779354Z","published_at":"2020-02-14T23:10:16Z","references":["https://osv.dev/vulnerability/GHSA-5xf4-f2fq-f69j","https://nvd.nist.gov/vuln/detail/CVE-2019-10773","https://github.com/yarnpkg/yarn/issues/7761#issuecomment-565493023","https://github.com/yarnpkg/yarn/pull/7755","https://github.com/yarnpkg/yarn/commit/039bafd74b7b1a88a53a54f8fa6fa872615e90e7","https://access.redhat.com/errata/RHSA-2020:0475","https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HIZW4NZVV5QY5WWGW2JRP3FHYKZ6ZJ5","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITY5BC63CCC647DFNUQRQ5AJDKUKUNBI","https://snyk.io/vuln/SNYK-JS-YARN-537806,"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"GHSA-5xf4-f2fq-f69j","url":"https://osv.dev/vulnerability/GHSA-5xf4-f2fq-f69j"}],"summary":"Yarn Improper link resolution before file access (Link Following)"}