CVE-2025-8262
yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos
A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The patch is identified as 97731871e674bf93bcbf29e9d3258da8685f3076. It is recommended to apply a patch to fix this issue.
Es wurde eine problematische Schwachstelle in yarnpkg Yarn bis 1.22.22 ausgemacht. Es betrifft die Funktion explodeHostedGitFragment der Datei src/resolvers/exotics/hosted-git-resolver.js. Mittels dem Manipulieren mit unbekannten Daten kann eine inefficient regular expression complexity-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Patch wird als 97731871e674bf93bcbf29e9d3258da8685f3076 bezeichnet. Als bestmögliche Massnahme wird Patching empfohlen.
Inefficient Regular Expression Complexity
| 2025-07-26: | Advisory disclosed |
| 2025-07-26: | VulDB entry created |
| 2025-07-26: | VulDB entry last update |
mmmsssttt (VulDB User)
vuldb.com/?id.317850 (VDB-317850 | yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos)
vuldb.com/?ctiid.317850 (VDB-317850 | CTI Indicators (IOB, IOC, TTP, IOA))
vuldb.com/?submit.617393 (Submit #617393 | Yarn v1.22.22 Inefficient Regular Expression Complexity)
github.com/yarnpkg/yarn/pull/9199
github.com/...mmits/97731871e674bf93bcbf29e9d3258da8685f3076
Support options
