CyberRota Analysis
AI-GeneratedThe pnpm package manager is vulnerable to a directory traversal attack due to improper handling of package names from the env lockfile configDependencies section, allowing malicious repositories to create symlinks to arbitrary paths during installation. This can lead to unauthorized access or modification of files on the system where pnpm is executed. Organizations using affected versions of pnpm should prioritize upgrading to versions 10.34.4 or 11.8.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those names directly when creating config dependency symlinks under node_modules/.pnpm-config. A malicious repository can commit a crafted pnpm-lock.yaml whose env-lockfile document contains a traversal-shaped config dependency name. During pnpm install, pnpm installs the config dependency and creates a symlink at a path derived from that name. This vulnerability is fixed in 10.34.4 and 11.8.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)