https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:54:23 +0000 https://db.gcve.eu/vuln/cve-2026-50014 <p><strong>Affected:</strong> pnpm</p> <p>pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm passes the lockfile-controlled git resolution.commit value to git fetch without a -- separator or commit-format validation. For git dependencies fetched through the shallow-fetch path, a malicious lockfile can replace the expected 40-character commit hash with a Git option such as --upload-pack=&lt;command&gt;. For SSH and local transports, --upload-pack can execute the supplied command. HTTPS transports ignore --upload-pack, so the practical attack surface is primarily SSH or local git dependencies. This vulnerability is fixed in 10.34.0 and 11.4.0.</p> <p><strong>Affected:</strong> pnpm</p> <p>pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm passes the lockfile-controlled git resolution.commit value to git fetch without a -- separator or commit-format validation. For git dependencies fetched through the shallow-fetch path, a malicious lockfile can replace the expected 40-character commit hash with a Git option such as --upload-pack=&lt;command&gt;. For SSH and local transports, --upload-pack can execute the supplied command. HTTPS transports ignore --upload-pack, so the practical attack surface is primarily SSH or local git dependencies. This vulnerability is fixed in 10.34.0 and 11.4.0.</p> https://db.gcve.eu/vuln/cve-2026-50014 https://db.gcve.eu/vuln/ghsa-p4xf-rf54-rj3x <p><strong>Affected:</strong> npm: pnpm</p> <p>## Summary</p> <p>pnpm passes the lockfile-controlled git `resolution.commit` value to `git fetch` without a `--` separator or commit-format validation. For git dependencies fetched through the shallow-fetch path, a malicious lockfile can replace the expected 40-character commit hash with a Git option such as `--upload-pack=&lt;command&gt;`. For SSH and local transports, `--upload-pack` can execute the supplied command. HTTPS transports ignore `--upload-pack`, so the practical attack surface is primarily SSH or local git dependencies.</p> <p>## Vulnerability Details</p> <p>The vulnerable path is in `fetching/git-fetcher/src/index.ts`. When a git dependency host is configured for shallow fetching, pnpm calls:</p> <p>```typescript await execGit([&#39;fetch&#39;, &#39;--depth&#39;, &#39;1&#39;, &#39;origin&#39;, resolution.commit], { cwd: tempLocation }) ```</p> <p>Because `resolution.commit` is appended before a `--` separator, Git can parse a commit value beginning with `-` as an option. The same file later passes the value to `git checkout` without a separator:</p> <p>```typescript await execGit([&#39;checkout&#39;, resolution.commit], { cwd: tempLocation }) ```</p> <p>`resolution.commit` comes from the lockfile and is typed as a plain `string`; pnpm does not validate it as a 40-character hexadecimal commit before passing it to Git.</p> <p>## Proof of Concept</p> <p>```bash bash autofyn_audit/exploits/vuln11_git_upload_pack_rce/exploit.sh # Creates a local bare git repo and triggers the shallow-fetch path. # Replaces the lockfile commit hash with &#39;--upload-pack=touch /tmp/…</p> <p><strong>Affected:</strong> npm: pnpm</p> <p>## Summary</p> <p>pnpm passes the lockfile-controlled git `resolution.commit` value to `git fetch` without a `--` separator or commit-format validation. For git dependencies fetched through the shallow-fetch path, a malicious lockfile can replace the expected 40-character commit hash with a Git option such as `--upload-pack=&lt;command&gt;`. For SSH and local transports, `--upload-pack` can execute the supplied command. HTTPS transports ignore `--upload-pack`, so the practical attack surface is primarily SSH or local git dependencies.</p> <p>## Vulnerability Details</p> <p>The vulnerable path is in `fetching/git-fetcher/src/index.ts`. When a git dependency host is configured for shallow fetching, pnpm calls:</p> <p>```typescript await execGit([&#39;fetch&#39;, &#39;--depth&#39;, &#39;1&#39;, &#39;origin&#39;, resolution.commit], { cwd: tempLocation }) ```</p> <p>Because `resolution.commit` is appended before a `--` separator, Git can parse a commit value beginning with `-` as an option. The same file later passes the value to `git checkout` without a separator:</p> <p>```typescript await execGit([&#39;checkout&#39;, resolution.commit], { cwd: tempLocation }) ```</p> <p>`resolution.commit` comes from the lockfile and is typed as a plain `string`; pnpm does not validate it as a 40-character hexadecimal commit before passing it to Git.</p> <p>## Proof of Concept</p> <p>```bash bash autofyn_audit/exploits/vuln11_git_upload_pack_rce/exploit.sh # Creates a local bare git repo and triggers the shallow-fetch path. # Replaces the lockfile commit hash with &#39;--upload-pack=touch /tmp/…</p> https://db.gcve.eu/vuln/ghsa-p4xf-rf54-rj3x