Description
pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. The lockfile does not store the hash of the dependencies from https://codeload.github.com. This means that if this server was compromised or a person's machine configuration was compromised, pnpm would download and install these dependencies. This vulnerability is fixed in 10.33.4 and 11.0.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pnpm | pnpm | < 10.33.4, >= 11.0.0, < 11.0.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | pnpm-stage0 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | pnpm | < 10.33.4 | 10.33.4 | GHSA-hg3w-7f8c-63hp |
| npm | pnpm | >= 11.0.0, < 11.0.7 | 11.0.7 | GHSA-hg3w-7f8c-63hp |