CVE-2019-15608

The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.

• CWE-840
• CWE-367

• https://github.com/yarnpkg/yarn/blob/master/CHANGELOG.md#1190
• https://github.com/yarnpkg/yarn/commit/0474b8c66a8ea298f5e4dedc67b2de464297ad1c
• https://hackerone.com/reports/703138Exploit, Mitigation, Third Party Advisory
• https://github.com/yarnpkg/yarn/blob/master/CHANGELOG.md#1190
• https://github.com/yarnpkg/yarn/commit/0474b8c66a8ea298f5e4dedc67b2de464297ad1c
• https://hackerone.com/reports/703138Exploit, Mitigation, Third Party Advisory

Published

Mar 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15602The fileview package v0.1.6 has inadequate output encoding a…6.1
• CVE-2019-15603The seefl package v0.1.1 is vulnerable to a stored Cross-Sit…6.1
• CVE-2019-15604Improper Certificate Validation in Node.js 10, 12, and 13 ca…7.5
• CVE-2019-15605HTTP request smuggling in Node.js 10, 12, and 13 causes mali…9.8
• CVE-2019-15606Including trailing white space in HTTP header values in Node…9.8
• CVE-2019-15607A stored XSS vulnerability is present within node-red (versi…5.4
• CVE-2019-15609The kill-port-process package version < 2.2.0 is vulnerable …9.8
• CVE-2019-1561Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-15610Improper authorization in the Circles app 0.17.7 causes reta…4.3
• CVE-2019-15611Violation of Secure Design Principles in the iOS App 2.23.0 …4.9
• CVE-2019-15612A bug in Nextcloud Server 15.0.2 causes pending 2FA logins t…5.9
• CVE-2019-15613A bug in Nextcloud Server 17.0.1 causes the workflow rules t…8