Tempcollab

**Name of the Vulnerable Software and Affected Versions** pnpm versions prior to 10.34.0 pnpm versions prior to 11.4.0 **Description** pnpm passes the `git resolution.commit` value from the lockfile to the git fetch command without using a -- separator or performing commit-format validation. When git dependencies are fetched via the shallow-fetch path, a malicious lockfile can replace the 40-character commit hash with a Git option, such as `--upload-pack=<command>`. For local transports and SSH, the `--upload-pack` option can execute the specified command. HTTPS transports are not affected as they ignore this option. **Recommendations** Update pnpm to version 10.34.0 or later. Update pnpm to version 11.4.0 or later.

**Name of the Vulnerable Software and Affected Versions** pnpm versions prior to 10.34.0 pnpm versions prior to 11.4.0 **Description** The patch application pipeline (@pnpm/patch-package) fails to validate file paths extracted from .patch files. An attacker can provide a malicious patch file containing `../../` sequences in the diff --git header paths to traverse outside the package directory. This allows the attacker to write controlled content to or delete arbitrary files on the filesystem with the privileges of the user executing the install command. **Recommendations** Update pnpm to version 10.34.0 or later. Update pnpm to version 11.4.0 or later.

**Name of the Vulnerable Software and Affected Versions** pnpm versions prior to 10.34.0 pnpm versions prior to 11.4.0 **Description** The tarball extraction worker in the pnpm package manager fails to perform integrity verification when the `integrity` field is missing from the lockfile resolution. This creates a fail-open gap where an attacker who can modify the `pnpm-lock.yaml` file to remove the `integrity` field and control the content served by the registry URL can force `pnpm install --frozen-lockfile` to install altered packages without triggering an integrity error. **Recommendations** Update to version 10.34.0 or later. Update to version 11.4.0 or later.