Path Shortening Vulnerability in pnpm Package Manager

CVE-2024-47829

What is CVE-2024-47829?

The pnpm package manager has a vulnerability related to its path shortening function, which employed the MD5 hashing algorithm. This implementation can lead to path collisions, meaning two different libraries could be assigned the same storage path, creating ambiguity and potential conflicts. Although the libraries are stored within the /node_modules/ directory under their package names, the lack of version numbers exacerbates the issue, potentially allowing different versions of libraries to overwrite each other without notice. This vulnerability has been addressed in version 10.0.0, which no longer uses MD5 for path compression, thereby enhancing storage unique identification.

References