[SECURITY] Fedora 43 Update: yarnpkg-1.22.22-12.fc43

Fast, reliable, and secure dependency management...

[SECURITY] Fedora 42 Update: yarnpkg-1.22.22-12.fc42

Fast, reliable, and secure dependency management...

EUVD-2019-0447

Malware in sbrugna...

EUVD-2018-0816

Malware in sbrugna...

EUVD-2019-0608

Malware in sbrugna...

EUVD-2020-0291

Malware in sbrugna...

EUVD-2018-0806

Malware in sbrugna...

EUVD-2025-25475

Malicious code in bioql PyPI...

EUVD-2022-6622

Malicious code in bioql PyPI...

EUVD-2025-31043

Malicious code in bioql PyPI...

EUVD-2022-1051

Malicious code in bioql PyPI...

EUVD-2022-4410

Malicious code in bioql PyPI...

EUVD-2022-3152

Malicious code in bioql PyPI...

EUVD-2024-0674

Malicious code in bioql PyPI...

EUVD-2022-0922

Malicious code in bioql PyPI...

Advisory ROSA-SA-2025-3025

software: yarn 1.22.22 WASP: ROSA-CHROME unaffected versions = yarn-1.22.22.22-3 affected versions yarn-1.22.22.22-3 CVE-ID: CVE-2025-9308 BDU-ID: None CVE-Crit: LOW CVE-DESC.: Vulnerability in Yarn before version 1.22.22 in setOptions function of src/util/request-manager.js file. Possible attack...

CVE-2025-59828

Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-executed when running yarn --version. This could lead to a bypass of the directory trust dialog in Claude Code, as plugins would be executed prior to t...

CVE-2025-59828

Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-executed when running yarn --version. This could lead to a bypass of the directory trust dialog in Claude Code, as plugins would be executed prior to t...

CVE-2025-59828 Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions

Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-executed when running yarn --version. This could lead to a bypass of the directory trust dialog in Claude Code, as plugins would be executed prior to t...

CVE-2025-59828

CVE-2025-59828 affects Claude Code prior to version 1.0.39, where using Yarn 2.0+ can auto-execute Yarn plugins during yarn --version, bypassing the directory trust dialog and enabling arbitrary code execution. The issue does not affect Yarn Classic. Fix: upgrade Claude Code to 1.0.39 or later. S...