CVE-2023-37478 pnpm incorrectly parses tar archives relative to specification

pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via...

CVE-2023-37478

CVE-2023-37478 affects pnpm, where tarball parsing can cause a malicious package to be installed via pnpm even if it appears safe on npm or the registry. The issue stems from how pnpm parses tar archives and can lead to replacement of a safe package with a malicious one during installation. The v...