redhat/yarnpkg vulnerabilities

Latest redhat/yarnpkg CVEs

Newest publication first · page 1 of 2

1. CVE-2026-118773 Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

   Published 2026-10-29

   Medium·CVSS 6.3 EPSS 0.35%

   Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal...

2. CVE-2026-118764 minimatch: potential denial of service via globparts amplification

   Published 2026-10-29

   Medium·CVSS 6.9 EPSS 0.30%

   minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.....

3. CVE-2026-118664 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

   Published 2026-10-28

   High·CVSS 8.2 EPSS 0.32%

   decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full...

4. CVE-2026-110910 qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

   Published 2026-10-27

   Medium·CVSS 6.3 EPSS 0.29%

   Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & (or the configured delimiter), =, or # therefore becomes query string syntax instead of data, so a caller-supplied...

5. CVE-2026-112366 Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns

   Published 2026-10-19

   High·CVSS 8.7 EPSS 0.34%

   Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js s...

6. CVE-2026-110816 qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string

   Published 2026-10-14

   Medium·CVSS 6.3 EPSS 0.37%

   Summary qs.stringify with arrayFormat: 'comma' throws TypeError: Cannot convert object to primitive value when an array element cannot be coerced to a string, such as an object with an own non-callable toString ({ "toString": "x" }) or a null-prototype object. The comma format jo...

7. CVE-2026-106446 Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)

   Published 2026-10-06

   Critical·CVSS 9.8 EPSS 0.79%

   Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This iss...

8. CVE-2026-106445 Handlebars: JavaScript Injection via Own Property Check Bypass

   Published 2026-10-06

   Critical·CVSS 9.2 EPSS 0.59%

   Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. Wh...

9. CVE-2026-106444 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

   Published 2026-10-06

   Medium·CVSS 4.7 EPSS 0.29%

   Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that termin...

10. CVE-2026-102278 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

    Published 2026-09-28

    High·CVSS 7.5 EPSS 0.49%

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the na...

11. CVE-2026-102277 brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

    Published 2026-09-28

    Medium·CVSS 5.3 EPSS 0.43%

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing c...

12. CVE-2026-84375 js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

    Published 2026-09-01

    High·CVSS 7.5 EPSS 0.54%

    js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings...

13. CVE-2026-82562 qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)

    Published 2026-08-29

    Medium·CVSS 6.3 EPSS 0.54%

    Summary When qs.parse is called with comma: true and throwOnLimitExceeded: true, a comma-separated value under a bracket-push key (a[]=1,2,3,4) is split into an array without being compared against arrayLimit, while the same value under a flat key (a=1,2,3,4), an indexed key (a[0...

14. CVE-2026-82417 qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property

    Published 2026-08-29

    Medium·CVSS 6.3 EPSS 0.40%

    Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBuffer(obj) after checking only that the property is truthy, so a value s...

15. CVE-2026-55858 MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client

    Published 2026-08-28

    Medium·CVSS 5.9 EPSS 0.87%

    MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set...

16. CVE-2026-55857 MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

    Published 2026-08-28

    Medium·CVSS 5.9 EPSS 0.39%

    MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysql_clear_password pl...

17. CVE-2026-55856 MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake

    Published 2026-08-28

    Medium·CVSS 5.9 EPSS 0.44%

    MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCer...

18. CVE-2026-73643 js-yaml: Exponential parsing time in the flow collections leads to denial of service

    Published 2026-08-13

    High·CVSS 7.5 EPSS 0.49%

    js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a se...

19. CVE-2026-73566 node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

    Published 2026-08-13

    High·CVSS 7.5 EPSS 0.53%

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty membe...

20. CVE-2026-73089 Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

    Published 2026-08-11

    High·CVSS 7.5 EPSS 0.66%

    Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct (queries, context) result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allo...

21. CVE-2026-73088 Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

    Published 2026-08-11

    High·CVSS 7.5 EPSS 0.66%

    Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-sta...

22. CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

    Published 2026-08-03

    High·CVSS 7.5 EPSS 0.65%

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled in...

23. CVE-2026-18477 Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

    Published 2026-08-03

    Medium·CVSS 4.4 EPSS 0.10%

    A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being pe...

24. CVE-2026-18508 Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

    Published 2026-08-03

    Medium·CVSS 4.4 EPSS 0.14%

    A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the in...

25. CVE-2026-14257 brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash

    Published 2026-07-23

    High·CVSS 7.5 EPSS 0.64%

    brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.