SB2026080357 - Multiple vulnerabilities in pnpm

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080357

SB2026080357 - Multiple vulnerabilities in pnpm

Published: August 3, 2026 Updated: August 3, 2026

Security Bulletin ID SB2026080357
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to path traversal in the isolated-linker import target when processing a tarball dependency with a crafted manifest name during installation. A remote attacker can supply a specially crafted tarball dependency to overwrite files outside node_modules and execute arbitrary code.

User interaction is required to run pnpm install, and exploitation can occur even when installation is performed with --ignore-scripts.


2) Insertion of Sensitive Information Into Sent Data (CVE-ID: N/A)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into sent data in pnpm proxy settings handling when loading an untrusted pnpm-workspace.yaml containing environment placeholders in httpProxy, httpsProxy, or noProxy settings. A remote attacker can provide a crafted repository manifest to disclose sensitive information.

User interaction is required to run pnpm install in the untrusted repository, and the secret is exfiltrated during configuration loading before any lifecycle script runs.


3) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to write package files to arbitrary filesystem paths.

The vulnerability exists due to path traversal in lockfileToDepGraph when processing a crafted pnpm-lock.yaml file during installation. A remote attacker can supply a lockfile with traversal sequences in depPath keys to write package files to arbitrary filesystem paths.

User interaction is required to run pnpm install on the crafted lockfile.


Remediation

Install update from vendor's website.

References