Index › programming › yarn yarn 2 tools · 1 release line Yarn package manager. Every tool here carries the same sandbox boundary. $ kapsl yarn ⧉ $ kapsl yarnpkg ⧉ Source ↗ Registry ↗ Release lines we maintain · the project decides these findings shown are the whole project at that line Tag Resolves to Lifecycle Updated Findings What the tag promises ▸ latest 4.18.0 stable 2026-08-30 34 tracks the newest supported release stable — floats, carries security updates unstable — tracks pre-releases, may break eol — frozen, upstream is done Tools in this project · pick one to inspect all share one boundary Tool Capabilities Seccomp Findings Image Description ▸ yarn netrw default H21M11L2 yarn Package manager for JavaScript ▸ yarnpkg netrw default H21M11L2 yarn Package manager for JavaScript (alias of yarn) ▸ showing yarn yarnpkg from yarn@latest → 4.18.0 stable Findings H21M11L2 identical on amd64, arm64 — one table describes both CVE Sev CVSS Affects Description GHSA-3ppc-4f35-3m26 ↗ H 8.7 minimatch minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern GHSA-7h2j-956f-4vf2 ↗ H 8.7 @isaacs/brace-expansion @isaacs/brace-expansion has Uncontrolled Resource Consumption GHSA-9ppj-qmqm-q256 ↗ H 8.2 tar node-tar Symlink Path Traversal via Drive-Relative Linkpath GHSA-qffp-2rhf-9h96 ↗ H 8.2 tar tar has Hardlink Path Traversal via Drive-Relative Linkpath GHSA-r5fr-rjxr-66jc ↗ H 8.1 lodash lodash vulnerable to Code Injection via `_.template` imports key names GHSA-w7jw-789q-3m8p ↗ H 8.1 shell-quote shell-quote quote() does not escape newlines in object .op values GHSA-mwp4-54f8-5fhr ↗ H 7.7 ip-address ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass GHSA-23c5-xmqv-rm74 ↗ H 7.5 minimatch minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions GHSA-23hp-3jrh-7fpw ↗ H 7.5 tar node-tar: Decompression/parse DoS via unlimited input GHSA-2883-xcg3-v3hh ↗ H 7.5 js-yaml js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources GHSA-395f-4hp3-45gv ↗ H 7.5 shell-quote shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407) GHSA-5p4m-2wfm-xmqj ↗ H 7.5 js-yaml JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported GHSA-7r86-cg39-jmmj ↗ H 7.5 minimatch minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments GHSA-8x88-c5mf-7j5w ↗ H 7.5 tar node-tar: Negative tar entry size causes infinite loop in archive replace GHSA-96hv-2xvq-fx4p ↗ H 7.5 ws ws: Memory exhaustion DoS from tiny fragments and data chunks GHSA-c2c7-rcm5-vvqj ↗ H 7.5 picomatch Picomatch has a ReDoS vulnerability via extglob quantifiers GHSA-f8q6-p94x-37v3 ↗ H 7.5 minimatch minimatch ReDoS vulnerability GHSA-grv7-fg5c-xmjg ↗ H 7.5 braces Uncontrolled resource consumption in braces GHSA-mh99-v99m-4gvg ↗ H 7.5 brace-expansion brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash GHSA-r292-9mhp-454m ↗ H 7.5 tar node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection GHSA-rgw5-rvv9-x895 ↗ H 7.5 brace-expansion brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation GHSA-vmf3-w455-68vh ↗ M 6.9 tar node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling) GHSA-f23m-r3pf-42rh ↗ M 6.5 lodash lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` GHSA-f886-m6hf-6m8v ↗ M 6.5 brace-expansion brace-expansion: Zero-step sequence causes process hang and memory exhaustion GHSA-xxjr-mmjv-4gpg ↗ M 6.5 lodash Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions GHSA-3jxr-9vmj-r5cp ↗ M 5.3 brace-expansion brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups GHSA-3v7f-55p6-f55p ↗ M 5.3 picomatch Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching GHSA-952p-6rrq-rcjv ↗ M 5.3 micromatch Regular Expression Denial of Service (ReDoS) in micromatch GHSA-gvwx-54wh-qm9j ↗ M 5.3 tar node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records GHSA-pfrx-2q88-qq97 ↗ M 5.3 got Got allows a redirect to a UNIX socket GHSA-v2v4-37r5-5v8g ↗ M 5.3 ip-address ip-address has XSS in Address6 HTML-emitting methods GHSA-w8wr-v893-vjvp ↗ M 5.3 tar node-tar: Process crash via PAX numeric path type confusion GHSA-v6h2-p8h4-qcjw ↗ L 3.1 brace-expansion brace-expansion Regular Expression Denial of Service vulnerability GHSA-73rr-hh4g-fpgx ↗ L 2.7 diff jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch These are the findings of yarn, which ships every tool in this project. kapsl reports and gates; it never edits an image to clear a finding. Composition default + bash, env, git runtime node composes node, bash, env, git Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly. Composition default + bash, env, git runtime node composes node, bash, env, git Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly. Image name yarn platforms amd64 sha256:19c3…bf21 copy arm64 sha256:1dd6…ad66 copy size 4 MB unpacked · 1 layer base scratch signed cosign · 2026-08-30 · public key findings last changed 2026-09-16 Sandbox boundary yarn capabilities netrw Filled is granted to every invocation; the rest need --cap at the point of use. seccomp tier per tool default The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier. host paths mounted in read-only unless noted ~/.local/share/yarn · writable env passed through none none Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask. env set by kapsl 1 set YARN_ENABLE_TELEMETRY per-subcommand no overrides Every invocation gets the same boundary. Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere. Sandbox boundary yarnpkg capabilities netrw Filled is granted to every invocation; the rest need --cap at the point of use. seccomp tier per tool default The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier. host paths mounted in read-only unless noted ~/.local/share/yarn · writable env passed through none none Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask. env set by kapsl 1 set YARN_ENABLE_TELEMETRY per-subcommand no overrides Every invocation gets the same boundary. Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere. Provenance sbom amd64 ↗ arm64 ↗ attestation amd64 ↗ arm64 ↗ scan report amd64 ↗ arm64 ↗ vex amd64 ↗ arm64 ↗ Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust. 34 findings across this project at latest. Counted once per advisory across every image the project builds.