An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a     directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
    (CVE-2021-4435)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a
    directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
    (CVE-2021-4435)

An update of the yarn package has been released.

ID	Name	Product	Family	Severity
224223	Linux Distros Unpatched Vulnerability : CVE-2021-4435	Nessus	Misc.	high
417069	SCA: security update for yarn (GHSA-mpwj-fcr6-x34c)	Tenable Cloud Security	SCA Checks	high
417069	SCA: security update for yarn (GHSA-mpwj-fcr6-x34c)	Tenable Self-Hosted Container Security	SCA Checks	high
203870	Photon OS 3.0: Yarn PHSA-2024-3.0-0723	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2021-4435

high

Tenable Plugins

high

high

high

high