{"record":{"id":"84394c2215b01f1d","repo":"Kong/insomnia","slug":"unsafe-yarn-path-detected","errorCode":null,"errorMessage":"Unsafe yarn path detected.","messagePattern":"Unsafe yarn path detected\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/insomnia/src/main/install-plugin.ts","lineNumber":334,"sourceCode":" * Ensures no symlinks and the path is within the app folder.\n */\nexport async function getYarnPath() {\n  const SAFE_APP_BASE = path.resolve(__dirname, '..');\n\n  const appPath = app.getAppPath();\n  const resolvedAppPath = path.resolve(appPath);\n\n  // Validate app path is safe\n  if (!resolvedAppPath.startsWith(SAFE_APP_BASE)) {\n    throw new Error('Unsafe app path detected.');\n  }\n\n  const yarnPath = isDevelopment()\n    ? path.resolve(resolvedAppPath, './bin/yarn-standalone.js')\n    : path.resolve(resolvedAppPath, '../bin/yarn-standalone.js');\n\n  if (!yarnPath.startsWith(SAFE_APP_BASE)) {\n    throw new Error('Unsafe yarn path detected.');\n  }\n\n  // Ensure file exists and is not a symlink\n  try {\n    const stats = await lstat(yarnPath);\n\n    if (stats.isSymbolicLink()) {\n      throw new Error('yarn-standalone.js is a symlink, refusing to use it.');\n    }\n  } catch (err: any) {\n    if (err.code === 'ENOENT') {\n      throw new Error(`yarn-standalone.js not found at expected location: ${yarnPath}`);\n    }\n    throw err;\n  }\n\n  return yarnPath;\n}","sourceCodeStart":316,"sourceCodeEnd":352,"githubUrl":"https://github.com/Kong/insomnia/blob/d9bb2b0142600f21309832daea3317942d285984/packages/insomnia/src/main/install-plugin.ts#L316-L352","documentation":"Security guard in getYarnPath: the resolved path to yarn-standalone.js does not begin with the app's base directory (SAFE_APP_BASE), so the bundled yarn cannot be trusted. Indicates an unexpected app installation layout or tampering.","triggerScenarios":"Thrown at packages/insomnia/src/main/install-plugin.ts:334 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reinstall the app so binaries live under the expected app folder","Verify no symlink/shim is redirecting the app path","Run the official build rather than a relocated copy"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d9bb2b0142600f21309832daea3317942d285984","analyzedAt":"2026-08-26T18:04:05.187Z","contentChangedAt":"2026-08-26T18:04:05.187Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}