pnpm incorrectly parses tar archives relative to specification
CVE-2023-37478
7.5HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2023-37478?
A vulnerability in the pnpm package manager allows crafted tarballs to appear benign when installed via npm but turn malicious when processed by pnpm. This flaw relates to the way pnpm handles tar archives, leading to a potential security risk where a compromised package is installed unknowingly. Users are advised to upgrade to pnpm versions 7.33.4 or 8.6.8, where the issue has been addressed.
Affected Version(s)
pnpm < 7.33.4 < 7.33.4
pnpm >= 8.0.0, < 8.6.8 < 8.0.0, 8.6.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.