CVE-2023-37478: pnpm — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2023-37478

CVSS 9.8 · Critical EPSS 1,2%

Kerentanan Improper Access Control pada pnpm. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via npm being replaced with a compromised or malicious version when installed via pnpm. This issue has been patched in version(s) 7.33.4 and 8.6.8.

Rincian

Terbit di NVD: 1 Agustus 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-284: Improper Access Control
EPSS (30 hari): 1,2% peluang dieksploitasi; lebih tinggi dari 67,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
pnpm	pnpm	Semua versi sebelum 7.33.4
pnpm	pnpm	Versi 8.0.0 hingga sebelum 8.6.8

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/pnpm/pnpm/security/advisories/GHSA-5r98-f33j-g8h7 advisory vendor
https://github.com/pnpm/pnpm/releases/tag/v7.33.4 release notes
https://github.com/pnpm/pnpm/releases/tag/v8.6.8 release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.