CVE-2025-8262
No fix known EPSS <1%CVSS 4.3
A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The patch is identified as 97731871e674bf93bcbf29e9d3258da8685f3076. It is recommended to apply a patch to fix this issue.
Products: yarnpkg Yarn
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | yarn | no fix |
| Debian:12 | node-yarnpkg | no fix |
| Debian:13 | node-yarnpkg | no fix |
| Debian:14 | node-yarnpkg | no fix |
| Ubuntu:20.04:LTS | node-yarnpkg | no fix |
| Ubuntu:22.04:LTS | node-yarnpkg | no fix |
| Ubuntu:24.04:LTS | node-yarnpkg | no fix |
| Ubuntu:25.10 | node-yarnpkg | no fix |
| Ubuntu:26.04:LTS | node-yarnpkg | no fix |
| Ubuntu:26.10 | node-yarnpkg | no fix |
| Wolfi | yarn | no fix |