-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability was caused by pnpm mishandling overrides and the global cache, allowing a workspace to poison the global cache and execute scripts in another workspace. The patch addresses this by ensuring that mutated metadata is not saved to the cache.
The pickPackage function was identified as vulnerable because it was responsible for saving metadata to the cache. The modification to stringify the metadata before calling saveMeta ensures that any subsequent mutations to the meta object in pickPackage are not reflected in the cached data.
The saveMeta function was also modified to accept the already stringified metadata, further ensuring the integrity of the cached data. The test case added in resolving/npm-resolver/test/index.ts specifically verifies that mutated metadata is not saved to the cache, confirming the fix.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pnpm | npm | < 9.15.0 | 9.15.0 |