Code Execution Vulnerability in pnpm Package Manager by PNPM

CVE-2024-53866

What is CVE-2024-53866?

The pnpm package manager, prior to version 9.15.0, exhibits a critical flaw with its handling of workspace overrides and the global cache. This vulnerability allows overrides from one workspace to leak into the npm metadata stored in the global cache, leading to a situation where npm metadata can inadvertently affect other workspaces. Furthermore, the default behavior of installations does not revalidate data, which includes the first lockfile generation process. This breakdown of expected security protocols results in the potential for workspace A to compromise the global cache, inadvertently allowing malicious code to execute in workspace B, even when the ignore-scripts flag is set. This unintended execution undermines user trust in the package manager's ability to maintain the integrity and security of code installations. Users are urged to upgrade to version 9.15.0 or implement separate cache and store directories in each workspace as a temporary solution.

References