Nixpkgs security tracker
7.1 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): Required (R)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): High (H)
- Availability (A): Low (L)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): Low (L)
Activity log
- Created suggestion
pnpm: stage download writes outside destination via manifest version traversal
pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file. The merged fix validates both fields, derives one safe filename, and verifies the final destination before writing. This vulnerability is fixed in 11.5.3.
References
-
https://github.com/pnpm/pnpm/security/advisories/GHSA-v23m-ccfg-pq9h x_refsource_CONFIRM
-
https://github.com/pnpm/pnpm/pull/12303 x_refsource_MISC
Affected products
- ==>= 11.3.0, < 11.5.3
Matching in nixpkgs
pkgs.pnpm
Fast, disk space efficient package manager for JavaScript
pkgs.pnpm_10
Fast, disk space efficient package manager for JavaScript
pkgs.pnpm_11
Fast, disk space efficient package manager for JavaScript
pkgs.pnpm_12
Fast, disk space efficient package manager for JavaScript
-
nixos-unstable -
- nixos-unstable-small 12.3.4
pkgs.pnpm_10_29_2
Fast, disk space efficient package manager for JavaScript
pkgs.pnpm_10_34_0
Fast, disk space efficient package manager for JavaScript
-
nixos-unstable -
- nixos-unstable-small 10.34.0
pkgs.pnpmBuildHook
None
pkgs.pnpmConfigHook
None
pkgs.pnpm-fixup-state-db
None
pkgs.pnpm-shell-completion
Complete your pnpm command fastly
Package maintainers
-
@Scrumplex Sefa Eyeoglu <contact@scrumplex.net>
-
@gepbird Gutyina Gergő <gutyina.gergo.2@gmail.com>
-
@donovanglover Donovan Glover