REDHAT-BUG-2427709: High severity pnpm vulnerability
pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution disabled by default". While pnpm v10 blocks postinstall scripts via the onlyBuiltDependencies mechanism, git dependencies can still execute prepare, prepublish, and prepack scripts during the fetch phase, enabling remote code execution without user consent or approval. This issue is fixed in version 10.26.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.26.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2427709?
The severity of REDHAT-BUG-2427709 is rated as high, with a score of 7.
How do I fix REDHAT-BUG-2427709?
To fix REDHAT-BUG-2427709, upgrade pnpm to version 10.26 or later.
What vulnerability does REDHAT-BUG-2427709 exploit?
REDHAT-BUG-2427709 exploits a flaw that allows git-hosted dependencies to execute arbitrary code during pnpm install.
Which versions of pnpm are affected by REDHAT-BUG-2427709?
pnpm versions 10.0.0 through 10.25 are affected by REDHAT-BUG-2427709.
What security feature is circumvented in REDHAT-BUG-2427709?
REDHAT-BUG-2427709 circumvents the security feature that disables dependency lifecycle scripts execution by default in pnpm.