pnpm Vulnerability: Hoisted Install Imports Lockfile Alias Outside node_modules

Vulnerability Overview CAND-PNPM-059: hoisted install imports lockfile alias outside node_modules This vulnerability involves hoisted dependency aliases being incorrectly imported outside the directory in pnpm and pacquet. Attackers can bypass the boundary by crafting malicious lockfile aliases, thereby overwriting the layout owned by pnpm. This patch prevents path traversal during graph insertion or file system operations by validating package name semantics and path constraints. Affected Versions Affected versions: - pnpm =11.0.0 =10.34.4 =11.7.0 Fix Description 1. TypeScript hoisted graph uses shared safe join helper: - A TypeScript container helper is defined in . - When parsing the hoisted graph, the resolved dependency names are validated. 2. Pacquet validates hoister's dep.name: - Rust bounds are mirrored in . - The hoister's is validated before adding graph nodes or during recursion. 3. Implementation returns errors: - Both implementations return the error. 4. Dependency name inclusion rules: - Pacquet uses the same dependency name inclusion rules in its hoisted graph sink for direct dependency aliases. Proof of Concept (POC) No specific POC code is provided in the page, but the exploitation method is described as follows: Prior to the patch, packages imported via hoisted lockfile aliases could bypass the expected installation root directory. By crafting malicious lockfile aliases, it is possible to overwrite the layout owned by pnpm. Validation TypeScript symlink helper: 24 passed. TypeScript exploit regression: 1 passed. TypeScript positive hoisted install control: 1 passed. Targeted pnpm TypeScript compiles: passed. Targeted ESLint: zero errors. Pacquet helper tests: 3 passed. Full pacquet package-manager library suite: 426 passed. cargo fmt, parsed two-document lockfile validation, and git diff --check: passed. Patch The patch is ready for review; the private PR link is: https://github.com/pnpm/pnpm/pull/591 The GitHub report branch is mergeable, and review has been requested from . GitHub intentionally does not run status checks on temporary private-fork PRs; the commands and outcomes listed above are the recorded local validation. Compatibility Valid unscoped and scoped package aliases continue to work. Changesets cover and , and is updated in the same commit to maintain CLI consistency. --- Summary: This vulnerability involves hoisted dependency aliases being incorrectly imported outside the directory, potentially leading to path traversal and layout overwrites. The fix involves validating package name semantics and path constraints, ensuring consistency in dependency name inclusion rules. The patch is ready for review, and validation results show all tests passed.

Goal Reached Thanks to every supporter — we hit 100%!

pnpm Vulnerability: Hoisted Install Imports Lockfile Alias Outside node_modules

More from this source