PT-2025-17640 · Pnpm · Pnpm

Published 2025-04-23 · Updated 2025-05-03 · CVE-2024-47829

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.0.0

Description The issue is related to the path shortening function in pnpm, which uses the md5 function as a compression function. If a collision occurs, it can result in the same storage path for two different libraries. Although the real names are under the package name /node modules/, there are no version numbers for the libraries they refer to.

Recommendations For versions prior to 10.0.0, update to version 10.0.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the path shortening function until a patch is applied.

Exploit

Fix

Weakness Enumeration

CWE-328

Related Identifiers

BDU:2025-06425

CVE-2024-47829

GHSA-8CC4-RFJ6-FHG4

Affected Products

Pnpm

References · 11

• 🔥 https://github.com/pnpm/pnpm/security/advisories/GHSA-8cc4-rfj6-fhg4 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47829.json · Exploit
• https://bdu.fstec.ru/vul/2025-06425 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47829 · Security Note
• https://osv.dev/vulnerability/GHSA-8cc4-rfj6-fhg4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47829 · Vendor Advisory
• https://github.com/pnpm/pnpm · Note
• https://twitter.com/Cezar_H_Linux/status/1918696641319633150 · Twitter Post
• https://twitter.com/CVEnew/status/1915071212083990966 · Twitter Post
• https://t.me/cvetracker/22203 · Telegram Post
• https://twitter.com/Cezar_H_Linux/status/1918690415840055331 · Twitter Post