CVE-2024-47829

MediumCVSS 6.5/10Last modified Jun 22, 2026

Description

pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression function, and if a collision occurs, it will result in the same storage path for two different libraries. Although the real names are under the package name /node_modoules/, there are no version numbers for the libraries they refer to. This issue has been patched in version 10.0.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-328

Affected software

No affected versions have been published.

Timeline

Published: Apr 23, 2025
Last modified: Jun 22, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-47836.4The jQuery T(-) Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tminus shortcode in all CVE-2024-478305.8Plane is an open-source project management tool. Plane uses the ** wildcard support to retrieve the image from any hostname as in /web/next.CVE-2024-478317.5Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerab CVE-2024-478329.8ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker CVE-2024-478336.5Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In a CVE-2024-478349.1GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affect CVE-2024-478357.5GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in t CVE-2024-478364.3Admidio is an open-source user management solution. Prior to version 4.3.12, an unsafe deserialization vulnerability allows any unauthentica CVE-2024-47845.4An issue was discovered in GitLab EE starting from version 16.7 before 17.0.6, version 17.1 before 17.1.4 and 17.2 before 17.2.2 that allowe CVE-2024-478404.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediaw CVE-2024-478417.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Ext CVE-2024-478458.2Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Code Injection.This issue