CVE-2024-47829
📋 TL;DR
This vulnerability in pnpm (package manager) uses MD5 hashing for path shortening, which can cause collisions where two different libraries get stored in the same directory path. This affects developers and systems using pnpm versions before 10.0.0, potentially causing package corruption or unexpected behavior during installation.
💻 Affected Systems
- pnpm
📦 What is this software?
Pnpm by Pnpm
⚠️ Risk & Real-World Impact
Worst Case
Package corruption leading to runtime errors, dependency confusion attacks where malicious packages overwrite legitimate ones, or broken builds causing application failures.
Likely Case
Intermittent installation failures, corrupted node_modules directories, or inconsistent package versions across environments.
If Mitigated
Minor installation issues that might be mistaken for network or cache problems, with no direct security compromise.
🎯 Exploit Status
Exploitation requires crafting package names that produce MD5 collisions, making practical attacks difficult but theoretically possible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.0
Vendor Advisory: https://github.com/pnpm/pnpm/security/advisories/GHSA-8cc4-rfj6-fhg4
Restart Required: No
Instructions:
1. Check current pnpm version: pnpm --version
2. Update pnpm globally: npm install -g pnpm@10.0.0
3. Verify update: pnpm --version
4. Clear pnpm store if experiencing issues: pnpm store prune
🔧 Temporary Workarounds
Use alternative package manager temporarily
allSwitch to npm or yarn for package management until pnpm can be updated.
npm install
yarn install
Manual package installation
allInstall critical packages directly without using pnpm's store mechanism.
npm install <package-name> --no-save
🧯 If You Can't Patch
- Monitor build logs for package installation failures or corruption warnings
- Implement checksum verification for critical dependencies in CI/CD pipelines
🔍 How to Verify
Check if Vulnerable:
Run: pnpm --version and check if version is less than 10.0.0Check Version:
pnpm --versionVerify Fix Applied:
Run: pnpm --version and confirm version is 10.0.0 or higher📡 Detection & Monitoring
Log Indicators:
- Package installation failures
- Hash collision warnings in pnpm logs
- Unexpected package overwrites in node_modules
Network Indicators:
- Repeated package downloads for same dependency
- Unusual package resolution patterns
SIEM Query:
process.name="pnpm" AND (log_message:"collision" OR log_message:"hash" OR log_message:"corrupt")