pnpm Lockfile Injection Leading to Code Execution (CAND-PNPM-063)

Vulnerability Overview CAND-PNPM-063: Project environment lockfile can short-circuit package manager resolution and execute pnpm bytecode selected by the lockfile Vulnerability Description: pnpm persists package manager bootstrapping metadata in the first YAML document of . Prior to the patch, direct execution trusted the resolved entries when the committed environment lockfile contained matching and versions. Consequently, a malicious repository could commit package manager lockfile records and snapshots that bypass standard package manager resolution, leading to install and execute bytecode selected by the committed lockfile state during automatic version switching. CVSS Score: 8.8 / 10 (High) Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High Scope of Impact Affected Products: - Ecosystem: npm - Package Names: , - Affected Versions: Current versions. Prior to the patch, direct execution interacts with package manager auto-switching and repository-controlled environment lockfiles. - Patched Version: A version containing this patch is yet to be released. Remediation Maintainer Action Plan: - The report is ready for review of the shared patch branch. Initiate the PR and expected fix behavior, then replace the original path with a detailed exploit narrative. - Shared Patch PR: https://github.com/pnpm/pnpm/ghsa-jhc-m6cf-6jmbjybl - Shared Patch Branch: - Patch Commit: - Base Commit: - Maintainer Priority: - Component: - Patch Area: The package manager environment lockfile is re-resolved before execution via a trusted registry. - Affected Packages: , - CWE IDs: CWE-829, CWE-494, CWE-345 - Conservative CVSS: 8.8 / CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Next Steps: Review the components in the shared patch branch, define the final scope of affected versions, merge and publish the fix, then publish or close the advisory. Expected Patch Behavior: - Package manager entries in the committed environment lockfile are forced to refresh via the trusted registry prior to execution; attacker tarball requests and tags remain zero. Patch Details: - The patch causes automatic package manager switching to re-resolve repository-provided bootstrapping metadata prior to installation and execution. - accepts a argument to bypass the version-match fast path. - creates a store controller even if the committed environment lockfile already contains an entry satisfying the package manager dependency version. - calls and forces it for the resolved package manager entry. - assigns the returned environment lockfile back to , allowing to install from the newly resolved metadata. - Package manager bootstrapping registry hardening is reused from CAND-PNPM-061, ensuring refreshes occur via the trusted package manager registry rather than the workspace registry. Changed Files: - - - - Pacquet Section: - No Pacquet-side patch is required because Pacquet does not implement 's package manager auto-switching path or . Proof of Concept (POC) Code Verification Results POC confirms that the parser does not force reuse of the version-matching environment lockfile, demonstrating the original primitive. The patched calls and forces resolution for the package manager entry in the committed environment lockfile. The patched assigns the returned environment lockfile back to . The installer receives the refreshed lockfile instead of the poisoned committed lockfile. TypeScript builds pass for and . Patched Jest regression tests pass, with 1 skipped test in . ESLint passes on the affected package manager switch files. passes. Residual Risks The helper still possesses an unforced fast path that handles matching and versions as resolved. Current execution-sensitive callers use a trusted registry or pass through the patched boundary, but future execution paths should use prior to installing or executing bytecode from repository-provided environment lockfiles.

Goal Reached Thanks to every supporter — we hit 100%!

pnpm Lockfile Injection Leading to Code Execution (CAND-PNPM-063)

More from this source