CVE-2025-9308

low-risk
Published 2025-08-21

A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation leads to inefficient regular expression complexity. Local access is required to approach this attack. This vulnerability only affects products that are no longer supported by the maintainer.

Do I need to act?

-
0.02% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.3/10 Low
LOCAL / LOW complexity

Affected Products (1)

Yarn

Affected Vendors

Yarnpkg

References (5)

Exploit https://github.com/yarnpkg/yarn/pull/9203
Permissions Required https://vuldb.com/?ctiid.320913
Third Party Advisory https://vuldb.com/?id.320913
Third Party Advisory https://vuldb.com/?submit.633486
Exploit https://github.com/yarnpkg/yarn/pull/9203
18
/ 100
low-risk
Severity 13/34 · Low
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal