Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-hg3w-7f8c-63hp

Опубликовано: 26 июн. 2026
Источник: github
Github: Прошло ревью
CVSS4: 4.8

Описание

pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

Summary

A malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile.

Details

The lockfile does not store the hash of the dependencies from https://codeload.github.com

This means that if this server was compromised or a person's machine configuration was compromised, pnpm would download and install these dependencies.

PoC

> pnpm -v 10.28.2

Given the following package.json:

{ "dependencies": { "add": "git://github.com/dsherret/npm-git-dep.git#b3eeb9b" } }

This produces a lockfile like so:

lockfileVersion: '9.0' settings: autoInstallPeers: true excludeLinksFromLockfile: false importers: .: dependencies: add: specifier: git://github.com/dsherret/npm-git-dep.git#b3eeb9b version: https://codeload.github.com/dsherret/npm-git-dep/tar.gz/b3eeb9b packages: add@https://codeload.github.com/dsherret/npm-git-dep/tar.gz/b3eeb9b: resolution: {tarball: https://codeload.github.com/dsherret/npm-git-dep/tar.gz/b3eeb9b} version: 1.0.0 snapshots: add@https://codeload.github.com/dsherret/npm-git-dep/tar.gz/b3eeb9b: {}

Notice that there is no hash. The b3eeb9b is not sufficient because I can configure my machine to resolve a compromised tarball from that url (I tested it out and pnpm just installs it).

Impact

Anyone relying on github git dependencies.

Пакеты

Наименование

pnpm

npm
Затронутые версииВерсия исправления

< 10.33.4

10.33.4

Наименование

pnpm

npm
Затронутые версииВерсия исправления

>= 11.0.0, < 11.0.7

11.0.7

EPSS

Процентиль: 6%
0.00161
Низкий

4.8 Medium

CVSS4

Дефекты

CWE-353

Связанные уязвимости

CVSS3: 7.5
redhat
около 1 месяца назад

pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. The lockfile does not store the hash of the dependencies from https://codeload.github.com. This means that if this server was compromised or a person's machine configuration was compromised, pnpm would download and install these dependencies. This vulnerability is fixed in 10.33.4 and 11.0.7.

CVSS3: 7.5
nvd
около 1 месяца назад

pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. The lockfile does not store the hash of the dependencies from https://codeload.github.com. This means that if this server was compromised or a person's machine configuration was compromised, pnpm would download and install these dependencies. This vulnerability is fixed in 10.33.4 and 11.0.7.

CVSS3: 7.5
debian
около 1 месяца назад

pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious co ...

EPSS

Процентиль: 6%
0.00161
Низкий

4.8 Medium

CVSS4

Дефекты

CWE-353