GHSA-VM32-9RQF-RH3R vulnerabilities

Vulnerabilities for packages: pnpm...

pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion

Summary pnpm seems to mishandle overrides and global cache: 1. Overrides from one workspace leak into npm metadata saved in global cache 2. npm metadata from global cache affects other workspaces 3. installs by default don't revalidate the data including on first lockfile generation This can make...

CVE-2024-53866 vulnerabilities

Vulnerabilities for packages: pnpm...

CVE-2024-53866 vulnerabilities

Vulnerabilities for packages: pnpm...

CVE-2024-53866

The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data including on first...

CVE-2024-53866 pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion

The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data including on first...

CVE-2024-53866 pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion

The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data including on first...

CVE-2024-53866 pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion

The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data including on first...

CVE-2024-53866

The CVE-2024-53866 entry concerns pnpm before 9.15.0, where overrides from one workspace can leak into npm metadata stored in global cache, and global-cache data can affect other workspaces. This undermines global state integrity and can enable arbitrary code execution on installs, even when igno...

CVE-2024-53866: Untrusted Search Path

The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data including on first...

pnpm 代码问题漏洞

pnpm is a package manager in the pnpm open source. A code issue vulnerability exists in pnpm 9.14.4 and earlier versions, which stems from the presence of a vulnerability that improperly handles overrides and global caching, which can lead to arbitrary code being run in subsequent installations...

Improper Package Validation

pnpm is vulnerable to Improper Package Validation. The library has the ability to produce tarballs that are harmful when installed using pnpm but safe when installed using npm or the registry. As a result, when a package is installed via pnpm, a malicious version may replace the one that was...

@pnpm/exe (>=8.0.0-alpha.0, <=8.6.7) potentially affected by CVE-2023-37478 via @pnpm/linux-x64 (>=8.0.0, <=8.6.7)

@pnpm/linux-x64 NPM version =8.0.0, =8.0.0-alpha.0, =8.6.7 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

@pnpm/exe (>=7.0.0-alpha.0, <=7.33.3) potentially affected by CVE-2023-37478 via @pnpm/macos-x64 (>=7.0.0, <=7.33.3)

@pnpm/macos-x64 NPM version =7.0.0, =7.0.0-alpha.0, =7.33.3 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

@pnpm/exe (>=8.0.0-alpha.0, <=8.6.7) potentially affected by CVE-2023-37478 via @pnpm/win-x64 (>=8.0.0, <=8.6.7)

@pnpm/win-x64 NPM version =8.0.0, =8.0.0-alpha.0, =8.6.7 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

@pnpm/exe (>=7.0.0-alpha.0, <=7.33.3) potentially affected by CVE-2023-37478 via @pnpm/win-x64 (>=7.0.0, <=7.33.3)

@pnpm/win-x64 NPM version =7.0.0, =7.0.0-alpha.0, =7.33.3 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

@pnpm/exe (>=8.0.0-alpha.0, <=8.6.7) potentially affected by CVE-2023-37478 via @pnpm/macos-x64 (>=8.0.0, <=8.6.7)

@pnpm/macos-x64 NPM version =8.0.0, =8.0.0-alpha.0, =8.6.7 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

ynpm-tool (>=4.0.5-pnpm.15, <=5.5.11) potentially affected by CVE-2023-37478 via pnpm (>=7.2.1, <=7.5.1)

pnpm NPM version =7.2.1, =4.0.5-pnpm.15, =5.5.11 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

@pnpm/exe (>=7.0.0-alpha.0, <=7.33.3) potentially affected by CVE-2023-37478 via @pnpm/linux-x64 (>=7.0.0, <=7.33.3)

@pnpm/linux-x64 NPM version =7.0.0, =7.0.0-alpha.0, =7.33.3 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

GHSA-5R98-F33J-G8H7 pnpm incorrectly parses tar archives relative to specification

Summary It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. Details The TAR format is an append-only archive format, and as such, the specification for how to update a...