CVE Details
Basic Information
| Title | yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos |
|---|---|
| Type | cve |
| Published | 2025-07-28T07:02:05.616Z |
| Modified | 2025-07-28T07:02:05.616Z |
Product Information
| Vendor | yarnpkg |
|---|---|
| Product | Yarn |
| Version | 1.22.0 |
CVSS Information
| Base Score | 5.3 (MEDIUM) |
|---|---|
| Attack Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X |
Affected Products
- yarnpkg Yarn 1.22.0
- yarnpkg Yarn 1.22.1
- yarnpkg Yarn 1.22.2
- yarnpkg Yarn 1.22.3
- yarnpkg Yarn 1.22.4
- yarnpkg Yarn 1.22.5
- yarnpkg Yarn 1.22.6
- yarnpkg Yarn 1.22.7
- yarnpkg Yarn 1.22.8
- yarnpkg Yarn 1.22.9
- yarnpkg Yarn 1.22.10
- yarnpkg Yarn 1.22.11
- yarnpkg Yarn 1.22.12
- yarnpkg Yarn 1.22.13
- yarnpkg Yarn 1.22.14
- yarnpkg Yarn 1.22.15
- yarnpkg Yarn 1.22.16
- yarnpkg Yarn 1.22.17
- yarnpkg Yarn 1.22.18
- yarnpkg Yarn 1.22.19
- yarnpkg Yarn 1.22.20
- yarnpkg Yarn 1.22.21
- yarnpkg Yarn 1.22.22
Additional Information
| CWE List | CWE-1333, CWE-400 |
|---|---|
| Source | VulDB |
Description
A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The patch is identified as 97731871e674bf93bcbf29e9d3258da8685f3076. It is recommended to apply a patch to fix this issue.