CVE Feed

    Dashboard / CVE / CVE-2023-37478

    CVE-2023-37478

    pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via npm being replaced with a compromised or malicious version when installed via pnpm. This issue has been patched in version(s) 7.33.4 and 8.6.8.

    Published:Aug 1, 2023
    Last Modified:Nov 21, 2024
    EPS:Aug 1, 2023
    EPSS Score:0.01368
    CVSS Score:7.5

    Affected Products

    Vendor
    Pnpm
    Product
    Pnpm

    Exploits

    https://github.com/li-minhao/CVE-2023-37478-Demohttps://github.com/TrevorGKann/CVE-2023-37478_npm_vs_pnpm

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    Related CVEs

    CVE-2026-82393 (CVSS 7.5) — pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dep…
    CVE-2026-82392 (CVSS 7.1) — pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from a…
    CVE-2026-59195 (CVSS 8.2) — pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile confi…
    CVE-2026-59196 (CVSS 7.1) — pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined directly unde…
    CVE-2026-59194 (CVSS 7.1) — pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the config…
    CVE-2026-55180 (CVSS 6.5) — pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from…
    CVE-2026-48995 (CVSS 4.8) — pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whate…
    CVE-2026-50017 (CVSS 6.9) — pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm can send user-level unscoped npm authentication c…
    CVE-2026-50016 (CVSS 8.8) — pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registr…
    CVE-2026-50015 (CVSS 7.3) — pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's patch application pipeline (@pnpm/patch-package…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High