PT-2024-35964 · Pnpm · Pnpm

Chalker · Published 2024-12-10 · Updated 2025-09-22 · CVE-2024-53866

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: pnpm versions prior to 9.15.0

Description: The package manager pnpm seems to mishandle overrides and global cache. This can lead to overrides from one workspace leaking into npm metadata saved in the global cache, affecting other workspaces. Installs by default do not revalidate the data, including on first lockfile generation. This breaks the expectation that ignore-scripts is sufficient to prevent immediate code execution on install. Global state integrity is lost via operations that one would expect to be secure, enabling subsequently running arbitrary code execution on installs.

Recommendations: For versions prior to 9.15.0, update to version 9.15.0 to fix the issue. As a temporary workaround, use separate cache and store directories in each workspace.

Exploit

Fix

Untrusted Search Path

Origin Validation Error

Weakness Enumeration

CWE-426

CWE-346

Related Identifiers

CVE-2024-53866

GHSA-VM32-9RQF-RH3R

Affected Products

Pnpm

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53866.json · Exploit
• https://github.com/pnpm/pnpm/commit/11afcddea48f25ed5117a87dc1780a55222b9743 · Patch
• https://github.com/pnpm/pnpm/security/advisories/GHSA-vm32-9rqf-rh3r · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vm32-9rqf-rh3r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53866 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53866 · Vendor Advisory
• https://github.com/pnpm/pnpm · Note
• https://t.me/cvedetector/12529 · Telegram Post
• https://t.me/cveNotify/136045 · Telegram Post
• https://twitter.com/CVEnew/status/1866571300178890894 · Twitter Post