Описание
pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause pnpm install --ignore-scripts to replace paths in the current project with symlinks to attacker-controlled dependency package directories. This vulnerability is fixed in 10.34.0 and 11.4.0.
A flaw was found in pnpm, a package manager. This vulnerability allows a malicious registry package to include specially crafted dependency aliases that contain path traversal segments. During the installation process, pnpm incorrectly processes these aliases, which can lead to the replacement of legitimate project paths with symbolic links (symlinks) pointing to directories controlled by an attacker. This could enable an attacker to execute arbitrary code or manipulate project files, severely impacting the integrity and security of the project.
Отчет
This Important flaw in pnpm, a JavaScript package manager, allows an attacker to achieve arbitrary code execution by publishing a malicious package to a registry. During installation, even with --ignore-scripts, specially crafted dependency aliases can lead to path traversal, replacing legitimate project files with symlinks to attacker-controlled directories. This bypasses expected security measures and can compromise the integrity of a project when subsequent commands are executed.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat AMQ Broker 7 | pnpm | Not affected | ||
| Red Hat Build of Keycloak | pnpm | Affected | ||
| Red Hat JBoss Enterprise Application Platform 8 | pnpm | Not affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | pnpm | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
8 High
CVSS3
Связанные уязвимости
pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause `pnpm install --ignore-scripts` to replace paths in the current project with symlinks to attacker-controlled dependency package directories. This vulnerability is fixed in 10.34.0 and 11.4.0.
pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a ...
pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
EPSS
8 High
CVSS3