cve/2019/CVE-2019-15608.md

### [CVE-2019-15608](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15608)
![](https://img.shields.io/static/v1?label=Product&message=yarn&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%201.19.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Business%20Logic%20Errors%20(CWE-840)&color=brightgreen)

### Description

The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.

### POC

#### Reference
- https://github.com/yarnpkg/yarn/commit/0474b8c66a8ea298f5e4dedc67b2de464297ad1c
- https://hackerone.com/reports/703138

#### Github
No PoCs found on GitHub currently.