CVE-2024-47829 - CVE House
Back to Database
Status published Medium CVE-2024-47829

pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting

Vulnerability Description

pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression function, and if a collision occurs, it will result in the same storage path for two different libraries. Although the real names are under the package name /node_modoules/, there are no version numbers for the libraries they refer to. This issue has been patched in version 10.0.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-47829

Credits & Attribution

No credits recorded in the NVD database.

References

More from pnpm

View All →
CVE-2025-69264
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
High 8.8
CVE-2025-69263
pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies
High 7.5
CVE-2025-69262
pnpm vulnerable to Command Injection via environment variable substitution
High 7.6
CVE-2024-53866
pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion
Medium 5.8
CVE-2023-37478
pnpm incorrectly parses tar archives relative to specification
High 7.5

Affected Vendor

Affected Software

pnpm
Vulnerable Versions:
< 10.0.0

Timeline

Official Publish: April 23rd, 2025
Last Modified: April 23rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Weaknesses (CWE)

CWE-328

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.