SB20260410101 - Fedora 43 update for yarnpkg

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260410101

SB20260410101 - Fedora 43 update for yarnpkg

Published: April 10, 2026

Security Bulletin ID SB20260410101
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Code Injection (CVE-ID: CVE-2026-4800)

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper control of code generation in _.template when processing untrusted options.imports key names. A remote attacker can supply crafted imports key names to execute arbitrary code.

Code execution occurs at template compilation time. If Object.prototype has been polluted by another vector, inherited polluted keys can also be copied into the imports object and passed to Function().


2) Prototype pollution (CVE-ID: CVE-2025-64718)

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation. A remote attacker can pass specially crafted input to the application and perform prototype pollution attacks.


Remediation

Install update from vendor's website.

References