Skip to content
OpenAdvisories

Vendor

pnpm

31 known vulnerabilities.

Products

pnpm 31
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2023-37478 Public exploit

    pnpm incorrectly parses tar archives relative to specification

    pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on t…

    pnpm pnpm pnpm @pnpm/linuxstatic-arm64 npm