The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. Its not computed again when reading from the cache. This may lead to a cache pollution attack.
The product checks the state of a resource before using that resource, but the resource’s state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Yarn | Yarnpkg | * | 1.19.0 (excluding) |
| Node-yarnpkg | Ubuntu | eoan | * |
| Node-yarnpkg | Ubuntu | trusty | * |
| Node-yarnpkg | Ubuntu | upstream | * |