pnpm vulnerabilities (Root)
15 vulnerabilities.
-
pnpmRoot pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config 8.2 High -
pnpmRoot pnpm: patch-remove could delete project-selected files outside the patches directory 7.1 High -
pnpmRoot pnpm: hoisted install imports lockfile alias outside node_modules 7.1 High -
pnpmRoot pnpm: Repository config can expand victim environment secrets into registry requests before scripts run 6.5 Medium -
pnpmRoot pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile 4.8 Medium -
pnpmRoot pnpm binds unscoped user-level npm auth credentials to a repository-selected registry 6.9 Medium -
pnpmRoot pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement 8.8 High -
pnpmRoot pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal) 7.3 High -
pnpmRoot pnpm: Git Fetch Argument Injection via Lockfile resolution.commit 6.4 Medium -
pnpmRoot pnpm: Unsafe default behavior breaks integrity check 6.8 Medium -
pnpmRoot pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field 6.8 Medium -
pnpmRoot pnpm: reserved bin name deletes PNPM_HOME during global remove 6.5 Medium -
pnpmRoot pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes 8.8 High -
pnpmRoot pnpm: Repository-controlled configDependencies can select a pacquet native install engine 7.5 High -
pnpmRoot pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle 7.5 High