Zkochan

**Name of the Vulnerable Software and Affected Versions** pnpm versions prior to 10.34.4 pnpm versions prior to 11.7.0 **Description** A crafted patch entry can resolve outside the configured patches directory, allowing the `pnpm patch-remove` command to delete an arbitrary reachable file. **Recommendations** Update to version 10.34.4 or later. Update to version 11.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** pnpm versions prior to 10.34.4 pnpm versions prior to 11.7.0 **Description** A crafted lockfile alias can be joined directly under a hoisted node modules directory. Traversal aliases may allow escaping that directory, while reserved aliases such as `.bin` or `.pnpm` could overwrite the pnpm-owned layout. **Recommendations** Update to version 10.34.4. Update to version 11.7.0.

**Name of the Vulnerable Software and Affected Versions** pnpm versions prior to 10.34.2 pnpm versions 11.0.0 through 11.5.2 **Description** pnpm can persist package-manager bootstrap metadata in the first YAML document of the `pnpm-lock.yaml` file. The issue occurs when pnpm incorrectly trusts an already resolved `packageManagerDependencies` entry if the committed environment lockfile contains matching `pnpm` and `@pnpm/exe` versions. This trust failure during automatic version switching allows a malicious repository to commit crafted lockfile package records and snapshots that bypass fresh package-manager resolution. An attacker can exploit this by committing a crafted `pnpm-lock.yaml` file. When a victim runs pnpm in that repository with auto-switching enabled, pnpm may install and execute attacker-selected bytes. This can lead to arbitrary code execution with the privileges of the user, potentially compromising developer workstations and CI runners. Technical details include the following: - **API Endpoints**: Not applicable. - **Vulnerable Parameters or Variables**: `packageManagerDependencies` within the `pnpm-lock.yaml` file. - **Function Names**: `switchCliVersion()` and `resolvePackageManagerIntegrities()`. **Recommendations** Upgrade pnpm to version 10.34.2. Upgrade pnpm to version 11.5.3.

**Name of the Vulnerable Software and Affected Versions** pnpm versions prior to 10.34.2 pnpm versions prior to 11.5.3 **Description** Manifest bin object keys such as "", ".", and ".." bypass the bin-name guard. If a malicious package is installed globally, subsequent global remove, update, or add-replacement operations can re-derive these names from the installed manifest. This allows the software to pass `path.join(globalBinDir, binName)` to the `removeBin()` function. Consequently, using "." targets the global bin directory, while ".." targets its parent directory. **Recommendations** Update to version 10.34.2. Update to version 11.5.3.

**Name of the Vulnerable Software and Affected Versions** pnpm versions 11.3.0 through 11.5.2 **Description** The `pnpm stage download` command derives a local filename using package name and version fields controlled by the registry. A crafted manifest can lead to a path traversal, allowing an attacker to escape the designated download directory and overwrite other reachable files. **Recommendations** Update to version 11.5.3.

**Name of the Vulnerable Software and Affected Versions** PNPM versions 6.15.1 and below **Description** The issue is related to an untrusted search path in PNPM, which can cause the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This occurs when the application is run on Windows OS. **Recommendations** For PNPM versions 6.15.1 and below, update to a version above 6.15.1 to resolve the issue. As a temporary workaround, consider avoiding the execution of PNPM commands in directories that may contain malicious content. Restrict access to sensitive directories to minimize the risk of exploitation.