CVE-2024-53866

The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data including on first...

@agrada_digital/pbm (>=0.0.88 <=0.2.7), @bella-ui/components (>=1.0.0 <=1.0.10) +376 more potentially affected by CVE-2024-53866 via pnpm (>=0.21.0 <=9.14.4)

pnpm NPM version =0.21.0, =0.0.88, =1.0.0, =0.1.5, =1.0.0, =1.0.0, =0.2.2, =2.1.1, =0.1.16, =0.2.1, =0.0.1, =0.1.0, =0.1.1 - @designid/tokens =0.1.1 and more Source cves: CVE-2024-53866 Source advisory: OSV:GHSA-VM32-9RQF-RH3R...

CVE-2024-53866 vulnerabilities

Vulnerabilities for packages: pnpm...

CVE-2024-53866

The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data including on first...

CVE-2024-53866 vulnerabilities

Vulnerabilities for packages: pnpm...

CVE-2024-53866 pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion

The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data including on first...

CVE-2024-53866 pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion

The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data including on first...

CVE-2024-53866 pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion

The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data including on first...

CVE-2024-53866

The CVE-2024-53866 entry concerns pnpm before 9.15.0, where overrides from one workspace can leak into npm metadata stored in global cache, and global-cache data can affect other workspaces. This undermines global state integrity and can enable arbitrary code execution on installs, even when igno...

CVE-2024-53866

creationtimestamp| type| source ---|---|--- 2024-12-10 16:19:48+00:00| published-proof-of-concept| https://github.com/pnpm/pnpm/security/advisories/GHSA-vm32-9rqf-rh3r 2024-12-10 17:20:06+00:00| seen| https://infosec.exchange/users/cve/statuses/113629669818413679 2024-12-10 19:59:09+00:00| seen|...