CVE-2023-37478highCWE-284

CVE-2023-37478: fallo de gravedad alta en pnpm

pnpm incorrectly parses tar archives relative to specification

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear pnpm+ Monitorear pnpm

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 1.2%
pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via npm being replaced with a compromised or malicious version when installed via pnpm. This issue has been patched in version(s) 7.33.4 and 8.6.8.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
pnpm · pnpm
CVEs relacionadas — pnpm

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-69262HIGHpnpm vulnerable to Command Injection via environment variable substitutionEPSS 1.0%CVE-2025-69264HIGHpnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"EPSS 1.0%CVE-2024-53866MEDIUMpnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasionEPSS 1.0%CVE-2026-82393HIGHpnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on installEPSS 0.6%CVE-2026-82392HIGHpnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraphEPSS 0.6%CVE-2026-50016HIGHpnpm: Transitive dependency alias path traversal allows project path override via symlink replacementEPSS 0.5%