CVE-2023-37478

Summary

CVE-2023-37478 is a vulnerability affecting the package manager pnpm. Maliciously crafted tarballs can bypass security checks when installed via pnpm but are harmless when installed through npm or parsed by the registry. This can lead to the installation of compromised or malicious packages that appear safe on the npm registry. The issue has been resolved in versions 7.33.4 and 8.6.8 of pnpm.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.