pnpm incorrectly parses tar archives relative to specification
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 7.33.4, 8.6.8, 7.0.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 2 proofs of concept on GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: total
Summary
pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via npm being replaced with a compromised or malicious version when installed via pnpm. This issue has been patched in version(s) 7.33.4 and 8.6.8.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- pnpm pnpm
fixed in 7.33.4; From 8.0.0 · fixed in 8.6.8
- pnpmnpm
fixed in 7.33.4
- @pnpm/exenpm
fixed in 7.33.4
- @pnpm/linux-arm64npm
fixed in 7.33.4
- @pnpm/linux-x64npm
fixed in 7.33.4
- @pnpm/linuxstatic-arm64npm
fixed in 7.33.4
- @pnpm/macos-arm64npm
fixed in 7.33.4
- @pnpm/macos-x64npm
fixed in 7.33.4
- @pnpm/win-x64npm
fixed in 7.33.4
- @pnpm/cafsnpm
fixed in 7.0.5
- pnpmnpm
From 8.0.0 · fixed in 8.6.8
- @pnpm/exenpm
From 8.0.0 · fixed in 8.6.8
- @pnpm/linux-arm64npm
From 8.0.0 · fixed in 8.6.8
- @pnpm/linux-x64npm
From 8.0.0 · fixed in 8.6.8
- @pnpm/linuxstatic-arm64npm
From 8.0.0 · fixed in 8.6.8
- @pnpm/macos-arm64npm
From 8.0.0 · fixed in 8.6.8
- @pnpm/macos-x64npm
From 8.0.0 · fixed in 8.6.8
- @pnpm/win-x64npm
From 8.0.0 · fixed in 8.6.8