CVE-2025-8262

A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity. It is possible to launch...

CVE-2025-8262 yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos

A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity. It is possible to launch...

CVE-2025-8262

A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity. It is possible to launch...

Yarn 安全漏洞

Yarn is an open source package installation, management tool. A security vulnerability exists in Yarn 1.22.22 and earlier versions, which stems from a function explodeHostedGitFragment that causes regular expressions to be less complex...

PT-2025-31053 · Unknown +1 · Yarnpkg Yarn +1

Name of the Vulnerable Software and Affected Versions: yarnpkg Yarn versions up to 1.22.22 Description: A vulnerability exists in the explodeHostedGitFragment function within the src/resolvers/exotics/hosted-git-resolver.js file. This manipulation results in inefficient regular expression...

Malware in yarn-test-git-repo

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in yarn-test-git-repo (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware edc9cafea25a24afd9f19a9a4ba2af18e06bd436e07baa0c8cb4250ab522228c Any computer that has this package installed or running should be considered...

MAL-2025-6137 Malicious code in yarn-test-git-repo (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware edc9cafea25a24afd9f19a9a4ba2af18e06bd436e07baa0c8cb4250ab522228c Any computer that has this package installed or running should be considered...

openslides (>=2.3.0b1, <=2.3.0), pex (>=1.4.6, <=1.5.3) +4 more potentially affected by CVE-2025-47273 via setuptools (40.9.0)

setuptools PYPI version 40.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - openslides =2.3.0b1, =1.4.6, =0.2.0, =0.2.2, =0.1.0, =0.2.3 Source cves: CVE-2025-47273 Source advisory: OSV:GHSA-5RJG-FVGR-3XXF...

openslides (>=2.3.0b1, <=2.3.0), pex (>=1.4.6, <=1.5.3) +4 more potentially affected by CVE-2025-47273 via setuptools (40.9.0)

setuptools PYPI version 40.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - openslides =2.3.0b1, =1.4.6, =0.2.0, =0.2.2, =0.1.0, =0.2.3 Source cves: CVE-2025-47273 Source advisory: OSV:PYSEC-2025-49...

[SECURITY] Fedora 41 Update: yarnpkg-1.22.22-7.fc41

Fast, reliable, and secure dependency management...

Exploit for CVE-2025-29927

Introduction By manipulating the x-middleware-subrequest req...

Linux Distros Unpatched Vulnerability : CVE-2021-4435

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious...

Malicious code in example-yarn (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-655 Malicious code in example-yarn (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

New Gorilla Botnet Launches Over 300,000 DDoS Attacks Across 100 Countries

Cybersecurity researchers have discovered a new botnet malware family called Gorilla aka GorillaBot that draws its inspiration from the leaked Mirai botnet source code. Cybersecurity firm NSFOCUS, which identified the activity last month, said the botnet "issued over 300,000 attack commands, with...

io.jenkins.plugins:bitbucket-kubernetes-credentials (202.v15b_72a_698524), io.jenkins.plugins:npm-yarn-wrapper-steps (>=0.0.1, <=0.4.0) +1 more potentially affected by CVE-2024-47805 via org.jenkins-ci.plugins:credentials (2.3.15)

org.jenkins-ci.plugins:credentials MAVEN version 2.3.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - io.jenkins.plugins:bitbucket-kubernetes-credentials 202.v15b72a698524 -...

org.apache.hama:hama-yarn (>=0.5.0, <=0.6.2) potentially affected by CVE-2024-23454 via org.apache.hadoop:hadoop-common (0.23.1)

org.apache.hadoop:hadoop-common MAVEN version 0.23.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hadoop:hadoop-common and may be impacted: - org.apache.hama:hama-yarn =0.5.0, =0.6.2 Source cves: CVE-2024-23454 Source advisory:...

MGASA-2024-0282 Updated nodejs & yarnpkg packages fix security vulnerabilities

Nodejs 22 is the new active LTS branch and 5 CVE are fixed. CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 High CVE-2024-22020 - Bypass network import restriction via data URL Medium CVE-2024-22018 - fs.lstat bypasses permission model Low CVE-2024-36137 - fs.fchown/fchmod bypasses...

Photon OS 3.0: Yarn PHSA-2024-3.0-0723

An update of the yarn package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-3.0-0723. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...