CVE-2019-5448: Yarnpkg Yarn

High severity, CVSS 8.1. EPSS: 0.7% chance of exploitation in the next 30 days.

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

Affected products

• Yarnpkg Yarn: before 1.17.3 (fixed in 1.17.3)

Published 2019-07-30. Last modified 2026-06-17.