Uh oh!
There was an error while loading. Please reload this page.
chore(deps): update pnpm to v9.15.0 [security] - #12
Open
auvo-renovate wants to merge 1 commit into
Open
Conversation
auvo-renovateforce-pushed
the
renovate/npm-pnpm-vulnerability
branch
from
July 7, 2025 21:10
ac93fdf to
d860046Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
9.0.4->9.15.0pnpm no-script global cache poisoning via overrides /
ignore-scriptsevasionCVE-2024-53866 / GHSA-vm32-9rqf-rh3r
More information
Details
Summary
pnpm seems to mishandle overrides and global cache:
This can make workspace A (even running with
ignore-scripts=true) posion global cache and execute scripts in workspace BUsers generally expect
ignore-scriptsto be sufficient to prevent immediate code execution on install (e.g. when the tree is just repacked/bundled without executing it).Here, that expectation is broken
Details
See PoC.
In it, overrides from a single run of A get leaked into e.g.
~/Library/Caches/pnpm/metadata/registry.npmjs.org/rimraf.jsonand persistently affect all other projects using the cachePoC
Postinstall code used in PoC is benign and can be inspected in https://www.npmjs.com/package/ponyhooves?activeTab=code, it's just a
console.logOn mac:
rm -rf ~/Library/Caches/pnpm ~/Library/pnpm/storeThis step is not required in general, but we'll be using a popular package for PoC that's likely cached
A/package.json:{ "name": "A", "pnpm": { "overrides": { "rimraf>glob": "npm:ponyhooves@1" } }, "dependencies": { "rimraf": "6.0.1" } }pnpm i --ignore-scripts(the flag is not required, but the point of the demo is to show that it doesn't help)B/package.json:{ "name": "B", "dependencies": { "rimraf": "6.0.1" } }pnpm iResult:
Also, that code got leaked into another project and it's lockfile now!
Impact
Global state integrity is lost via operations that one would expect to be secure, enabling subsequently running arbitrary code execution on installs
As a work-around, use separate cache and store dirs in each workspace
Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
pnpm/pnpm (pnpm)
v9.15.0: pnpm 9.15Compare Source
Minor Changes
Patch Changes
pnpm update --globalshould not crash if there are no any global packages installed #7898.pnpm update --interactiveif catalogs are used.Platinum Sponsors
Gold Sponsors
v9.14.4: pnpm 9.14.4Compare Source
Patch Changes
Platinum Sponsors
Gold Sponsors
Silver Sponsors
v9.14.3: pnpm 9.14.3Compare Source
Patch Changes
packageManagerfield check ofpackage.json#7959.Platinum Sponsors
Gold Sponsors
Silver Sponsors
v9.14.2Compare Source
Patch Changes
pnpm publish --jsonshould work #8788.Platinum Sponsors
Gold Sponsors
v9.14.1Compare Source
Minor Changes
pnpm pack --jsonto print packed tarball and contents in JSON format #8765.Patch Changes
pnpm execshould print a meaningful error message when no command is provided #8752.pnpm setupshould remove the CLI from the target location before moving the new binary #8173.ERR_PNPM_TARBALL_EXTRACTerror while installing a dependency from GitHub having a slash in branch name #7697.use-node-versionsetting is used and the system has no Node.js installed #8769..npmrcfiles to their correct types. For instance,child-concurrencyshould be a number, not a string #5075.manage-package-manager-versionsis set totrue.pnpm initshould respect the--diroption #8768.Platinum Sponsors
Gold Sponsors
v9.14.0Compare Source
v9.13.2: pnpm 9.13.2Compare Source
Patch Changes
dlxprocesses.Platinum Sponsors
Gold Sponsors
Silver Sponsors
v9.13.1: pnpm 9.13.1Compare Source
Patch Changes
Platinum Sponsors
Gold Sponsors
Silver Sponsors
v9.13.0: pnpm 9.13Compare Source
Minor Changes
The
self-updatenow accepts a version specifier to install a specific version of pnpm. E.g.:or
Patch Changes
Cannot read properties of undefined (reading 'name')that is printed while trying to render the missing peer dependencies warning message #8538.Platinum Sponsors
Gold Sponsors
Silver Sponsors
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.