CVE-2023-37478

    Dashboard / Vulnerabilities / CVE-2023-37478

    CVE-2023-37478

    Published: 1 Aug 2023Last Modified: 12 Sept 2026

    Summary: pnpm incorrectly parses tar archives relative to specification

    Details: pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via npm being replaced with a compromised or malicious version when installed via pnpm. This issue has been patched in version(s) 7.33.4 and 8.6.8.

    References: https://github.com/pnpm/pnpm/releases/tag/v7.33.4, https://github.com/pnpm/pnpm/releases/tag/v8.6.8, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37478.json, https://github.com/pnpm/pnpm/security/advisories/GHSA-5r98-f33j-g8h7, https://nvd.nist.gov/vuln/detail/CVE-2023-37478

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -9c2a7b38ca3bc8a90855161bfd4c4c0bff390103

    Affected versions

    v7.33.3
    v7.33.2
    v7.33.1
    v7.33.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-37478 | CVE-DB