pnpm 11.3.x < 11.5.3 Stage Download Path Traversal (CVE-2026-55700)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(325221);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/07");

  script_cve_id("CVE-2026-55700");
  script_xref(name:"IAVA", value:"2026-A-0637");

  script_name(english:"pnpm 11.3.x < 11.5.3 Stage Download Path Traversal (CVE-2026-55700)");

  script_set_attribute(attribute:"synopsis", value:
"The pnpm package installed on the remote host is affected by a path traversal vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of pnpm installed on the remote host is 11.3.x prior to 11.5.3. It is, therefore, affected by a path
traversal vulnerability:

  - From 11.3.0 until 11.5.3, pnpm stage download derived a local filename from registry-controlled package
    name and version fields. A crafted manifest could escape the selected download directory and overwrite
    another reachable file. The merged fix validates both fields, derives one safe filename, and verifies the
    final destination before writing. (CVE-2026-55700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/pnpm/pnpm/security/advisories/GHSA-v23m-ccfg-pq9h");
  script_set_attribute(attribute:"solution", value:
"Upgrade to pnpm version 11.5.3 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-55700");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:pnpm:pnpm");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

get_kb_item_or_exit('Host/nodejs/modules/enumerated');

var app = 'pnpm';
var app_info = vcf_extras::nodejs_modules::get_app_info(app:app);

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, app);

var constraints = [
  {'min_version': '11.3.0', 'fixed_version': '11.5.3'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);