PT-2022-17710 · Pnpm · Pnpm

Name of the Vulnerable Software and Affected Versions: PNPM versions 6.15.1 and below Description: The issue is related to an untrusted search path in PNPM, which can cause the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content...

@fengshangwuqi/appkit (>=1.0.22, <=1.0.29), @koj/strapi (>=1.4.1, <=1.4.3) +30 more potentially affected by CVE-2021-23362 via hosted-git-info (>=3.0.0, <=3.0.7)

hosted-git-info NPM version =3.0.0, =1.0.22, =1.4.1, =0.1.0, =4.0.0, =1.0.0, =3.0.0, =0.0.0-2020520224551, =0.1.0, =0.0.0-2020520224551, =0.0.0-2020520224551, =0.1.0, =0.0.0-2020520224551, =0.1.0, =0.0.0-2020520224551, =0.1.0, =0.1.10 and more Source cves: CVE-2021-23362 Source advisory:...

@fengshangwuqi/appkit (>=1.0.22, <=1.0.29), @koj/strapi (>=1.4.1, <=1.4.3) +30 more potentially affected by CVE-2021-23362 via hosted-git-info (>=3.0.0, <=3.0.7)

hosted-git-info NPM version =3.0.0, =1.0.22, =1.4.1, =0.1.0, =4.0.0, =1.0.0, =3.0.0, =0.0.0-2020520224551, =0.1.0, =0.0.0-2020520224551, =0.0.0-2020520224551, =0.1.0, =0.0.0-2020520224551, =0.1.0, =0.0.0-2020520224551, =0.1.0, =0.1.10 and more Source cves: CVE-2021-23362 Source advisory:...

@pnpm/headless (>=8.0.0, <=10.0.4), @pnpm/modules-cleaner (>=5.0.0, <=7.0.3) +4 more potentially affected by CVE-2019-10773 via @pnpm/package-bins (4.0.0)

@pnpm/package-bins NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @pnpm/package-bins and may be impacted: - @pnpm/headless =8.0.0, =5.0.0, =0.1.0, =0.1.0, =0.1.0, =0.35.0, =0.36.6 Source cves: CVE-2019-10773 Source advisory:...

421752593pro (5.6.0), @pnpm/default-fetcher (>=0.3.0, <=0.3.2) +8 more potentially affected by CVE-2018-7651 via ssri (>=5.0.0, <=5.2.1)

ssri NPM version =5.0.0, =0.3.0, =0.3.4, =1.19.6, =1.23.2, =1.4.9, =0.7.12, =0.7.13, =2.2.2 Source cves: CVE-2018-7651 Source advisory: OSV:GHSA-325J-24F4-QV5X...