CVE-2022-26183: vulnerability facts

CVE-2022-26183

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.

CVSS 8.8 · High · EPSS 1.6% · Fix available

Published: 2022-03-21T00:00:00.000Z
Updated: 2024-08-03T04:56:37.938Z

Stack: node

Affected products and versions

n/a
Versions
- n/a: Affected
No fix published
pnpm npm
Affected ranges
- SEMVER: < 6.15.1
Update to 6.15.1

Original sources

https://github.com/pnpm/pnpm/commit/04b7f60861ddee8331e50d70e193d1e701abeefb
https://github.com/pnpm/pnpm/releases/tag/v6.15.1
https://www.sonarsource.com/blog/securing-developer-tools-package-managers/
https://nvd.nist.gov/vuln/detail/CVE-2022-26183

Check your server →

CVE-2022-26183

Affected products and versions

n/a

pnpm npm

Original sources