5H1Kh4R

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted user, asset, or location IDs to create orphaned references that corrupt the asset ledger and audit trails.

Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id in the created by column instead of the authenticated caller's id. Authenticated attackers with consumables.checkout permission can perform checkouts that result in misattributed audit trail entries in the consumables users pivot table, obscuring which operator performed the action.

**Name of the Vulnerable Software and Affected Versions** pnpm versions prior to 10.34.4 pnpm versions prior to 11.8.0 **Description** pnpm accepts package names from the `configDependencies` section of the env lockfile and uses them directly when creating config dependency symlinks under `node modules/.pnpm-config`. A malicious repository can commit a crafted `pnpm-lock.yaml` file where the `env-lockfile` document contains a traversal-shaped config dependency name. During the installation process, pnpm creates a symlink at a path derived from that name, which can lead to path traversal. **Recommendations** Update to version 10.34.4. Update to version 11.8.0.