GHSA-9m87-6fj3-c5xh

Untrusted Search Path in PNPM

Source: GitHub Advisory Database (reviewed) High CVE-2022-26183

Packages

Ecosystem	Package	Affected	Fixed in
npm	pnpm	< 6.15.1	6.15.1

Details

As written in the advisory (Markdown source, shown as plain text).

PNPM prior to v6.15.1 was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-26183 advisory
https://github.com/pnpm/pnpm/commit/04b7f60861ddee8331e50d70e193d1e701abeefb web
https://github.com/pnpm/pnpm package
https://github.com/pnpm/pnpm/releases/tag/v6.15.1 web
https://www.sonarsource.com/blog/securing-developer-tools-package-managers web