PT-2022-17710 · Pnpm · Pnpm

Zkochan · Published 2022-03-21 · Updated 2023-11-09 · CVE-2022-26183

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PNPM versions 6.15.1 and below

Description The issue is related to an untrusted search path in PNPM, which can cause the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This occurs when the application is run on Windows OS.

Recommendations For PNPM versions 6.15.1 and below, update to a version above 6.15.1 to resolve the issue. As a temporary workaround, consider avoiding the execution of PNPM commands in directories that may contain malicious content. Restrict access to sensitive directories to minimize the risk of exploitation.

Exploit

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2022-26183

GHSA-9M87-6FJ3-C5XH

Affected Products

Pnpm

References · 8

• 🔥 https://sonarsource.com/blog/securing-developer-tools-package-managers · Exploit
• https://github.com/pnpm/pnpm/commit/04b7f60861ddee8331e50d70e193d1e701abeefb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-26183 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26183 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9m87-6fj3-c5xh · Vendor Advisory
• https://github.com/pnpm/pnpm/releases/tag/v6.15.1 · Note
• https://github.com/pnpm/pnpm · Note
• https://t.me/cibsecurity/39357 · Telegram Post