Yarn: untrusted search path

CVE-2021-4435 is an untrusted search path vulnerability in Yarn, a popular JavaScript package manager. When a victim runs certain Yarn commands in a directory containing attacker-controlled content, the application may inadvertently execute malicious commands due to improper handling of search paths [1][2]. The root cause lies in how Yarn resolves executable paths, allowing an attacker to place a malicious binary in a location that Yarn searches before the intended system path.

To exploit this vulnerability, an attacker must first convince a victim to navigate into a directory they control, such as a repository or project folder. The attacker then places a malicious executable or script in a location within that directory (e.g., a node_modules/.bin folder or similar). When the victim runs Yarn commands like yarn install or yarn run, Yarn may execute the malicious file instead of the intended binary, enabling arbitrary code execution [1][2]. No special privileges are required on the part of the attacker beyond file write access to the target directory.

Successful exploitation allows the attacker to execute arbitrary commands in the context of the victim user. This could lead to data exfiltration, installation of backdoors, or further compromise of the system. The vulnerability is limited to Yarn 1.x (the 1.22 line and earlier); later versions (Yarn 2/3/4, known as Berry) are not affected [3].

Red Hat has acknowledged the vulnerability and recommended updating to a patched version. The Yarn project released version 1.22.13 to address this issue [4]. Users running Yarn 1.x should upgrade to at least 1.22.13. For those on Yarn 1.x, migrating to the Berry line is strongly advised to avoid similar issues in the future [3].