CVE-2023-37478 - CVE House

Back to Database

Status published High CVE-2023-37478

pnpm incorrectly parses tar archives relative to specification

7.5 CVSS

Vulnerability Description

pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via npm being replaced with a compromised or malicious version when installed via pnpm. This issue has been patched in version(s) 7.33.4 and 8.6.8.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-37478

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from pnpm

View All →

pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"

pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies

pnpm vulnerable to Command Injection via environment variable substitution

pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion

pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting

Affected Vendor

pnpm

View all reports →

Affected Software

pnpm

Vulnerable Versions:

< 7.33.4, >= 8.0.0, < 8.6.8

Timeline

Official Publish: August 1st, 2023

Last Modified: October 10th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation