@pnpm/exe (>=8.0.0-alpha.0, <=8.6.7) potentially affected by CVE-2023-37478 via @pnpm/macos-arm64 (>=8.0.0, <=8.6.7)

@pnpm/macos-arm64 NPM version =8.0.0, =8.0.0-alpha.0, =8.6.7 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

@pnpm/exe (>=7.0.0-alpha.0, <=7.33.3) potentially affected by CVE-2023-37478 via @pnpm/linux-arm64 (>=7.0.0, <=7.33.3)

@pnpm/linux-arm64 NPM version =7.0.0, =7.0.0-alpha.0, =7.33.3 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

@pnpm/exe (>=8.0.0-alpha.0, <=8.6.7) potentially affected by CVE-2023-37478 via @pnpm/linux-arm64 (>=8.0.0, <=8.6.7)

@pnpm/linux-arm64 NPM version =8.0.0, =8.0.0-alpha.0, =8.6.7 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

CVE-2023-37478

pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via...

CVE-2023-37478 pnpm incorrectly parses tar archives relative to specification

pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via...

CVE-2023-37478 pnpm incorrectly parses tar archives relative to specification

pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via...

CVE-2023-37478

CVE-2023-37478 affects pnpm, where tarball parsing can cause a malicious package to be installed via pnpm even if it appears safe on npm or the registry. The issue stems from how pnpm parses tar archives and can lead to replacement of a safe package with a malicious one during installation. The v...

CVE-2023-37478 pnpm incorrectly parses tar archives relative to specification

pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via...

CVE-2023-37478: Improper Access Control

pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via...

PT-2023-25988 · Pnpm · Pnpm

Name of the Vulnerable Software and Affected Versions: pnpm versions prior to 7.33.4 pnpm versions prior to 8.6.8 Description: The issue arises from how pnpm parses tar archives, allowing a tarball to be constructed that appears safe when installed via npm or parsed by the registry but is malicio...

Malicious Package

Overview pnpm-utils is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

MAL-2022-5384 Malicious code in pnpm-local-install (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e53aa0e5484077b33dca99874f607f08f4996f8d1fa2e9fabc7b21f7aed81265 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pnpm-local-install (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e53aa0e5484077b33dca99874f607f08f4996f8d1fa2e9fabc7b21f7aed81265 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Untrusted Search Path in PNPM

PNPM prior to v6.15.1 was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS...

GHSA-9M87-6FJ3-C5XH Untrusted Search Path in PNPM

PNPM prior to v6.15.1 was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS...

Remote Code Execution (RCE)

pnpm is vulnerable to remote code execution. The vulnerability exists due an untrusted search path existing when running the application in Windows, which allows a malicious attacker to inject and execute pnpm commands...

CVE-2022-26183

PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS...

Design/Logic Flaw

PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS...

CVE-2022-26183

CVE-2022-26183 affects PNPM v6.15.1 and earlier on Windows, due to an untrusted search path that can cause the application to behave unexpectedly when run in directories containing malicious content. Root cause: untrusted search path in PNPM execution. Impact is described as abnormal behavior on ...

CVE-2022-26183: Untrusted Search Path

PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS...