Executive brief
pnpm is a package manager for Node.js projects that manages dependencies and installation scripts. This vulnerability allows an attacker to inject malicious package overrides into a shared global cache, which then affects other projects using the same cache—even those running with security protections like ignore-scripts enabled. This could lead to arbitrary code execution when other developers or CI systems install packages, compromising development environments and build systems.
Technical details
The vulnerability is a cache-poisoning flaw in pnpm's handling of package overrides and global metadata caching. When a workspace defines package overrides (CWE-346: Origin Validation Error, CWE-426: Untrusted Search Path), these overrides are incorrectly leaked into npm metadata stored in the global cache (e.g., ~/.pnpm/metadata). Subsequent workspace installs reuse this poisoned metadata without revalidation, allowing overridden packages—such as malicious post-install scripts—to execute even when ignore-scripts is set. Attack vector is network (via poisoned packages published to npm registry), with user interaction required (developer runs pnpm install). An attacker can craft a package with overrides that substitute legitimate dependencies with trojaned versions, achieving arbitrary code execution in any workspace sharing the cache. Fixed in pnpm 9.15.0; users should upgrade or use separate cache/store directories per workspace.
Affected products
- pnpm pnpm < 9.15.0
Timeline
- 2024-12-10: disclosed
- 2024-12-10: patched: Fixed in version 9.15.0