CVE-2024-47829
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
pnpm is a package manager that prior to version 10.0.0 used the md5 function for path shortening. In case of a collision, different libraries could share the same storage path, leading to version identification issues.
Risk Assessment
Organizations may face dependency management issues, which could lead to unpredictable application behavior and difficulties in updating libraries.
Recommendation
It is recommended to upgrade pnpm to version 10.0.0 or later to mitigate this vulnerability.
Original NVD description (English source)
pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression function, and if a collision occurs, it will result in the same storage path for two different libraries. Although the real names are under the package name /node_modoules/, there are no version numbers for the libraries they refer to. This issue has been patched in version 10.0.0.