CVE-2022-26183

2022-03-2122:15:07

Google

osv.dev

7.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.2%

JSON

PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.

CPENameOperatorVersion
pnpmeq5.2.8
pnpmeq4.1.3
pnpmeq4.10.0-1
pnpmeq5.2.0
pnpmeqpackage-store/0.21.0-0
pnpmeq1.35.2
pnpmeqpackage-store/0.23.0
pnpmeqdependencies-hierarchy/1.0.1
pnpmeq1.8.1
pnpmeq3.7.0

Name	Operator	Version
pnpm	eq	5.2.8
pnpm	eq	4.1.3
pnpm	eq	4.10.0-1
pnpm	eq	5.2.0
pnpm	eq	package-store/0.21.0-0
pnpm	eq	1.35.2
pnpm	eq	package-store/0.23.0
pnpm	eq	dependencies-hierarchy/1.0.1
pnpm	eq	1.8.1
pnpm	eq	3.7.0