https://vulnerability.circl.lu/sightings/feed 2026-09-04T00:46:53.584320+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/ae156ade-8473-49c1-9026-e4705f0400bc/export 2026-09-04T00:46:53.601069+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ae156ade-8473-49c1-9026-e4705f0400bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-2RX9-3G3H-C2JV", "type": "seen", "source": "https://gist.github.com/alon710/a2faaa6c3e9fca4817597ff64b25df31", "content": "# GHSA-2RX9-3G3H-C2JV: GHSA-2rx9-3g3h-c2jv: Path Traversal Vulnerability in pacquet Lockfile Parser and Filesystem Sinks\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/GHSA-2RX9-3G3H-C2JV\n\n## Summary\nA directory traversal vulnerability exists in pacquet, the Rust port of pnpm. When executing an install with the --trust-lockfile flag enabled, a crafted pnpm-lock.yaml file bypasses resolution-policy verification. This allows an attacker to inject path traversal sequences into package names or versions, leading to symbolic links being written outside the workspace directory.\n\n## TL;DR\nA path traversal vulnerability in pacquet allows unauthenticated remote code execution or file writes outside the workspace boundary via a crafted lockfile when using the --trust-lockfile parameter.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Local/Network via Crafted Lockfile\n- **CVSS v3.1 Score**: 8.1\n- **Exploit Status**: poc\n- **Affected Flag**: --trust-lockfile\n- **Impact**: Arbitrary Symlink Creation & File Write Outside Project Directory\n- **Fix Commit**: 51300fd41c5e4c8f47635108e373cc3d1f324fa7\n\n## Affected Systems\n\n- pacquet (Rust-based package manager port for pnpm)\n- pnpm (when executing pacquet install components)\n- **pnpm (pacquet)**: Prior to Commit 51300fd41c5e4c8f47635108e373cc3d1f324fa7 (Fixed in: `Commit 51300fd41c5e4c8f47635108e373cc3d1f324fa7`)\n\n## Mitigation\n\n- Upgrade pnpm to a version containing commit 51300fd41c5e4c8f47635108e373cc3d1f324fa7\n- Avoid running pnpm/pacquet installations with the --trust-lockfile argument in untrusted environments\n- Implement lockfile static analysis checks in CI/CD pipelines to block commits with directory traversal patterns\n\n**Remediation Steps:**\n1. Locate repositories utilizing pacquet or pnpm workspace setups.\n2. Update pnpm to the latest stable release carrying the security fix (Commit 51300fd41c5e4c8f47635108e373cc3d1f324fa7).\n3. Audit automated continuous integration scripts and remove any references to --trust-lockfile.\n4. Add a static analysis step or pre-commit check scanning pnpm-lock.yaml for relative traversal sequences.\n\n## References\n\n- [GitHub Security Advisory GHSA-2RX9-3G3H-C2JV](https://github.com/advisories/GHSA-2RX9-3G3H-C2JV)\n- [pnpm Repository Advisory GHSA-2rx9-3g3h-c2jv](https://github.com/pnpm/pnpm/security/advisories/GHSA-2rx9-3g3h-c2jv)\n- [Associated Pull Request #12872](https://github.com/pnpm/pnpm/pull/12872)\n- [Official Fix Commit](https://github.com/pnpm/pnpm/commit/51300fd41c5e4c8f47635108e373cc3d1f324fa7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-2RX9-3G3H-C2JV) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-01T20:22:11.263856Z"} 2026-09-01T20:22:11.263856+00:00