Medium severity4.3NVD Advisory· Published Jul 28, 2025· Updated Jun 17, 2026

CVE-2025-8262

Description

A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The patch is identified as 97731871e674bf93bcbf29e9d3258da8685f3076. It is recommended to apply a patch to fix this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

yarnpkg/Yarn3 versions
cpe:2.3:a:yarnpkg:yarn:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:yarnpkg:yarn:*:*:*:*:*:*:*:*range: <=1.22.22
- (no CPE)range: <=1.22.22
- (no CPE)range: 1.22.0

Patches

Vulnerability mechanics

References

github.com/yarnpkg/yarn/pull/9199/commits/97731871e674bf93bcbf29e9d3258da8685f3076nvdPatch
github.com/yarnpkg/yarn/pull/9199nvdExploit
vuldb.comnvdThird Party AdvisoryVDB Entry
vuldb.comnvdThird Party AdvisoryVDB Entry
vuldb.comnvdPermissions RequiredVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000