1. Home
  2. CVE Database
  3. CVE-2024-47829
MEDIUM · 6.5

CVE-2024-47829

pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression function, and if a collision occurs, it will result in the same ...

Vulnerability Description

pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression function, and if a collision occurs, it will result in the same storage path for two different libraries. Although the real names are under the package name /node_modoules/, there are no version numbers for the libraries they refer to. This issue has been patched in version 10.0.0.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW

Affected Products

VendorProductVersions
PnpmPnpm< 10.0.0

Related Weaknesses (CWE)

CWE-328

References

FAQ

What is CVE-2024-47829?

CVE-2024-47829 is a vulnerability with a CVSS score of 6.5 (MEDIUM). pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression function, and if a collision occurs, it will result in the same ...

How severe is CVE-2024-47829?

CVE-2024-47829 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-47829?

Check the references section above for vendor advisories and patch information. Affected products include: Pnpm Pnpm.