GitHub Advisoryadvisory · npm

GHSA-9m87-6fj3-c5xh Untrusted Search Path in PNPM

HIGH Published 2022-03-23 Modified 2022-03-30 Official page ↗
Aliases
CVE-2022-26183
Ecosystem
npm
Packages
pnpm
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-426
Reviewed
2022-03-29

Affected packages

• npm pnpm: < 6.15.1 → fixed in 6.15.1

Description

PNPM prior to v6.15.1 was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.

Related

Alias · CVE (1)

  • CVE-2022-26183 PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when… vulnerability

Weakness · CWE (1)

  • CWE-426 Untrusted Search Path weakness

References