pnpm@0.40.0

pnpm is a Fast, disk space efficient package manager

Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the default behavior of pnpm install, which accepts tarball content that does not match the integrity value recorded in the lockfile. An attacker who controls the registry can replace the content of a previously locked package version and have it installed in place of the locked version, because on a mismatch the install reports the discrepancy, then performs automatic resolution repair, accepts the registry's new integrity, and updates the lockfile. Exploitation applies only to non-frozen installs, meaning a plain pnpm install without --frozen-lockfile, and requires the attacker to control or compromise the registry so it serves different content for an already-published version.

Upgrade pnpm to version 10.34.0, 11.4.0 or higher.

pnpm is a Fast, disk space efficient package manager

Affected versions of this package are vulnerable to Relative Path Traversal in dependency alias handling, which passes alias names from package metadata into dependency linking as path components and normalizes them with path.join() without validation. An attacker can create symlinks at locations outside node_modules, such as .git/hooks, .husky, or .github/actions, and have their code execute on a later git commit, pnpm test, or pnpm publish, by publishing a dependency whose alias contains traversal segments like @x/../../../../../.git/hooks. Exploitation requires the victim to run pnpm install on a project that pulls in the malicious dependency, directly or transitively, and it proceeds even with pnpm install --ignore-scripts, so that flag is not a mitigation.

Upgrade pnpm to version 10.34.0, 11.4.0 or higher.

pnpm is a Fast, disk space efficient package manager

Affected versions of this package are vulnerable to Missing Support for Integrity Check involving GitHub git dependencies, because the tarball hash for packages resolved from codeload.github.com is not recorded in the lockfile. An attacker who controls or intercepts that server can cause arbitrary tarball content to be installed in place of a GitHub git dependency, since pnpm installs whatever is delivered without validating it against a stored hash. Exploitation affects only projects that resolve dependencies as GitHub git dependencies, and it requires the attacker to compromise codeload.github.com or intercept its TLS-protected connection, the recorded git commit reference alone being insufficient to detect the substitution.

Upgrade pnpm to version 10.33.4, 11.0.7 or higher.

pnpm is a Fast, disk space efficient package manager

Affected versions of this package are vulnerable to Arbitrary Argument Injection in the git fetcher at fetching/git-fetcher/src/index.ts, which passes the lockfile's resolution.commit value into git fetch and git checkout without a -- separator or format validation. An attacker can execute arbitrary commands as the user running the install by supplying a pnpm-lock.yaml whose resolution.commit is a git option such as --upload-pack=<command> instead of a 40-character hash. Exploitation requires the victim to install a project carrying the malicious lockfile and the git dependency to resolve over the SSH or local transport, as the HTTPS transport is not affected by --upload-pack injection.

Upgrade pnpm to version 10.34.0, 11.4.0 or higher.

pnpm is a Fast, disk space efficient package manager

Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the tarball extraction process when the integrity field is missing from the lockfile resolution. An attacker can introduce unauthorized package content by modifying the lockfile to remove the integrity field and serving altered packages from a registry URL.

Upgrade pnpm to version 10.34.1, 11.4.0 or higher.

pnpm is a Fast, disk space efficient package manager

Affected versions of this package are vulnerable to External Control of File Name or Path through the handling of reserved or malformed bin names during global package operations. An attacker can cause deletion of critical directories outside the intended global bin directory by publishing a malicious package with specially crafted manifest bin keys and then triggering global remove, update, or add-replacement flows.

Upgrade pnpm to version 10.34.2, 11.5.3 or higher.

pnpm is a Fast, disk space efficient package manager

Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the approval process for dependency sources. An attacker can execute unauthorized code during the build lifecycle by crafting a dependency source locator that collides with an approved source after normalization, thereby bypassing intended build policy restrictions.

Upgrade pnpm to version 10.34.2, 11.5.3 or higher.

pnpm is a Fast, disk space efficient package manager

Affected versions of this package are vulnerable to External Control of File Name or Path through the patch-remove process. An attacker can cause deletion of arbitrary files outside the intended directory by crafting a patch entry that resolves outside the configured patches directory.

Upgrade pnpm to version 10.34.4, 11.7.0 or higher.

pnpm is a Fast, disk space efficient package manager

Affected versions of this package are vulnerable to Directory Traversal via the patch application process. An attacker can overwrite or delete arbitrary files on the filesystem by submitting a malicious .patch file containing crafted file paths with directory traversal sequences, which are then processed during installation.

Upgrade pnpm to version 10.34.0, 11.4.0 or higher.

pnpm is a Fast, disk space efficient package manager

Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended node_modules directory by crafting a malicious lockfile alias that escapes the installation root.

Upgrade pnpm to version 10.34.4, 11.7.0 or higher.

pnpm is a Fast, disk space efficient package manager

Affected versions of this package are vulnerable to Directory Traversal via the configDependencies process. An attacker can create symlinks outside the intended directory by supplying crafted package names with traversal components in the lockfile.

Upgrade pnpm to version 10.34.4, 11.8.0 or higher.

pnpm is a Fast, disk space efficient package manager

Affected versions of this package are vulnerable to Use of Weak Hash for path shortening. An attacker can cause collisions in file paths, leading to the overwriting of indirect package dependencies by manipulating package names and versions to generate the same hash value.

Note:

This is only exploitable if the package names and versions are specifically crafted to exceed 120 characters and share the same hash output.

Upgrade pnpm to version 10.0.0-alpha.0 or higher.

pnpm is a Fast, disk space efficient package manager

Affected versions of this package are vulnerable to Untrusted Search Path due to mishandling of overrides and global cache settings even when ignore-scripts=true.

Upgrade pnpm to version 9.14.4 or higher.

pnpm is a Fast, disk space efficient package manager

Affected versions of this package are vulnerable to Access Control Bypass. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via npm being replaced with a compromised or malicious version when installed via pnpm.

Upgrade pnpm to version 7.33.4, 8.6.8 or higher.