CyberRota Analysis
AI-GeneratedA vulnerability in pnpm allows crafted lockfile aliases to be improperly handled, enabling traversal aliases to escape the hoisted node_modules directory and potentially overwrite critical pnpm-owned layouts. This could lead to unauthorized code execution or manipulation of package dependencies. Users of pnpm versions prior to 10.34.4 and 11.7.0 should prioritize updating to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined directly under a hoisted node_modules directory. Traversal aliases could escape that directory, while reserved aliases such as .bin or .pnpm could overwrite pnpm-owned layout. This vulnerability is fixed in 10.34.4 and 11.7.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)