Alerts This Week
Warning Icon 1 914
Alerts This Week
Warning Icon 1 914

Fedora 42: yarnpkg Command Injection Fix CVE-2025-64756 Advisory

fedora
Calendar Grey December 12, 2025
Dist Fedora Esm H88
Critical fix for yarnpkg in Fedora 42 to address CVE-2025-64756 command injection risk. Update recommended.
Fix CVE-2205-64756.

Summary

Fast, reliable, and secure dependency management.

Update Information:

Fix CVE-2205-64756.

Topics%20covered

Topics Covered

security advisory fedora important command injection yarnpkg cve-2025-64756

Change Log

* Wed Dec 3 2025 Sandro Mani - 1.22.22-14 - Bump release * Wed Dec 3 2025 Sandro Mani - 1.22.22-13 - Refresh bundle, fixes CVE-2025-64756

References


[ 1 ] Bug #2418529 - CVE-2025-64756 yarnpkg: glob CLI: Command injection via -c/--cmd executes matches with shell:true [epel-10] https://bugzilla.redhat.com/show_bug.cgi?id=2418529 [ 2 ] Bug #2418532 - CVE-2025-64756 yarnpkg: glob CLI: Command injection via -c/--cmd executes matches with shell:true [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2418532 [ 3 ] Bug #2418538 - CVE-2025-64756 yarnpkg: glob CLI: Command injection via -c/--cmd executes matches with shell:true [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2418538

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-4be1cd8390' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
important
Lowest
Low
Medium
High
Critical

Name: yarnpkg
Product: Fedora 42
Version: 1.22.22
Release: 14.fc42
URL: https://github.com/yarnpkg/yarn
Summary: Fast, reliable, and secure dependency management.

Topics%20covered

Topics Covered

security advisory fedora important command injection yarnpkg cve-2025-64756

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here