Secuno
ENNL
Book demo

CVE-2024-53866

Pnpm vulnerability

9.8 CRITICALPublic exploitEPSS 0.98%
  1. Published10 Dec 2024

Description

The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data (including on first lockfile generation). This can make workspace A (even running with `ignore-scripts=true`) posion global cache and execute scripts in workspace B. Users generally expect `ignore-scripts` to be sufficient to prevent immediate code execution on install (e.g. when the tree is just repacked/bundled without executing it). Here, that expectation is broken. Global state integrity is lost via operations that one would expect to be secure, enabling subsequently running arbitrary code execution on installs. Version 9.15.0 fixes the issue. As a work-around, use separate cache and store dirs in each workspace.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Pnpm< 9.15.0

Remediation

Fixed in
Pnpm≥ 9.15.0

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-592658.8
A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier…
CVE-2026-828628.4
Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe…
CVE-2026-781559.9
privilege escalation in StackGres operator allows a low-privilege tenant who owns a…
CVE-2026-748729.8
openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability…
CVE-2026-166748.8
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute…
CVE-2026-483958.6
Bridge is affected by an Untrusted Search Path vulnerability that could result in…

Frequently asked

Is CVE-2024-53866 being actively exploited?

CVE-2024-53866 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.98%.

How severe is CVE-2024-53866?

CVE-2024-53866 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.98% probability of exploitation.

Which products are affected by CVE-2024-53866?

Affected products include Pnpm.

How do I fix CVE-2024-53866?

Upgrade affected software to a fixed version, for example Pnpm 9.15.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-53866 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.