CVE-2024-53866

The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data including on first...

@coze-arch/cli (>=0.0.36-alpha.0a210b, <=0.1.8-alpha.6e99f9), @hakimedes/dsh-easyremote (>=0.2.5, <=0.3.4) +5 more potentially affected by CVE-2024-53866 via pnpm (>=9.0.0, <=9.14.4)

pnpm NPM version =9.0.0, =0.0.36-alpha.0a210b, =0.2.5, =2.25.6, =0.1.2, =1.4.0, =2.0.0, =26.1.4 Source cves: CVE-2024-53866 Source advisory: OSV:GHSA-VM32-9RQF-RH3R...

CVE-2024-53866

The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data including on first...

CVE-2024-53866 vulnerabilities

Vulnerabilities for packages: pnpm...

CVE-2024-53866 vulnerabilities

Vulnerabilities for packages: pnpm...

CVE-2024-53866 pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion

The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data including on first...

CVE-2024-53866 pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion

The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data including on first...

CVE-2024-53866 pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion

The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data including on first...

CVE-2024-53866

The CVE-2024-53866 entry concerns pnpm before 9.15.0, where overrides from one workspace can leak into npm metadata stored in global cache, and global-cache data can affect other workspaces. This undermines global state integrity and can enable arbitrary code execution on installs, even when igno...

CVE-2024-53866

creationtimestamp| type| source ---|---|--- 2024-12-10 16:19:48+00:00| published-proof-of-concept| https://github.com/pnpm/pnpm/security/advisories/GHSA-vm32-9rqf-rh3r 2024-12-10 17:20:06+00:00| seen| https://infosec.exchange/users/cve/statuses/113629669818413679 2024-12-10 19:59:09+00:00| seen|...