pnpm vulnerabilities (npm)
32 vulnerabilities.
-
pnpmnpm pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings 8.3 High -
pnpmnpm pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project 7.1 High -
pnpmnpm pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install 7.5 High -
pnpmnpm pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph 7.1 High -
pnpmnpm pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config 8.2 High -
pnpmnpm pnpm: patch-remove could delete project-selected files outside the patches directory 7.1 High -
pnpmnpm pnpm: hoisted install imports lockfile alias outside node_modules 7.1 High -
pnpmnpm pnpm: Repository config can expand victim environment secrets into registry requests before scripts run 6.5 Medium -
pnpmnpm pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile 4.8 Medium -
pnpmnpm pnpm binds unscoped user-level npm auth credentials to a repository-selected registry 6.9 Medium -
pnpmnpm pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement 8.8 High -
pnpmnpm pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal) 7.3 High -
pnpmnpm pnpm: Git Fetch Argument Injection via Lockfile resolution.commit 6.4 Medium -
pnpmnpm pnpm: Unsafe default behavior breaks integrity check 6.8 Medium -
pnpmnpm pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field 6.8 Medium -
pnpmnpm pnpm: stage download writes outside destination via manifest version traversal 7.1 High -
pnpmnpm pnpm: reserved bin name deletes PNPM_HOME during global remove 6.5 Medium -
pnpmnpm pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes 8.8 High -
pnpmnpm pnpm: Repository-controlled configDependencies can select a pacquet native install engine 7.5 High -
pnpmnpm pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle 7.5 High -
pnpmnpm pnpm has Path Traversal via arbitrary file permission modification 6.7 Medium -
pnpmnpm pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip) 6.5 Medium -
pnpmnpm pnpm has Windows-specific tarball Path Traversal 6.5 Medium -
pnpmnpm pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin 6.5 Medium -
pnpmnpm pnpm has symlink traversal in file:/git dependencies 6.7 Medium -
pnpmnpm pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default" 8.8 High -
pnpmnpm pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies 7.5 High -
pnpmnpm pnpm vulnerable to Command Injection via environment variable substitution 7.6 High -
pnpmnpm pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting 6.5 Medium -
pnpmnpm pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion 5.8 Medium -
pnpmnpm pnpm incorrectly parses tar archives relative to specification 7.5 High -
pnpmnpm Untrusted Search Path in PNPM 8.8 High