The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. Its not computed again when reading from the cache. This may lead to a cache pollution attack.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Yarn | Yarnpkg | * | 1.19.0 (excluding) |
| Node-yarnpkg | Ubuntu | eoan | * |
| Node-yarnpkg | Ubuntu | trusty | * |
| Node-yarnpkg | Ubuntu | upstream | * |