CVE-2023-37478

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via npm being replaced with a compromised or malicious version when installed via pnpm. This issue has been patched in version(s) 7.33.4 and 8.6.8.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Aug 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-374797.5Open Enclave is a hardware-agnostic open source library for developing applications that utilize Hardware-based Trusted Execution Environmen CVE-2023-37487.5A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an at CVE-2023-374804.9Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vuln CVE-2023-374814.9Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vuln CVE-2023-374825.3The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated re CVE-2023-374839.8SAP PowerDesigner - version 16.7, has improper access control which might allow an unauthenticated attacker to run arbitrary queries against CVE-2023-374845.3SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during logi CVE-2023-374867.5Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access i CVE-2023-374875.3SAP Business One (Service Layer) - version 10.0, allows an authenticated attacker with deep knowledge perform certain operation to access un CVE-2023-374886.1In SAP NetWeaver Process Integration - versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, user-controlled inputs, if not sufficiently CVE-2023-374895.3Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unau CVE-2023-37495.5A local user could edit the VideoEdge configuration file and interfere with VideoEdge operation.