CVE-2023-37478 pnpm incorrectly parses tar archives relative to specification

What is CVE-2023-37478?

CVE-2023-37478 is a high-severity vulnerability in pnpm, published on 1 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via npm being replaced with a compromised or malicious version when installed via pnpm. This issue has been patched in version(s) 7.33.4 and 8.6.8.

Weakness: CWE-284

Which versions are affected by CVE-2023-37478?

34 open source packages ship an affected version, including @pnpm/exe, @pnpm/cafs and @pnpm/linux-arm64. It affects 1 product.

Products include Pnpm Pnpm.

How do I fix CVE-2023-37478?

Upgrade @pnpm/exe to a fixed version for your release line: 7.33.4 or 8.6.8.

Is CVE-2023-37478 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-37478 exists.

Public exploit code: 2 proofs of concept on GitHub.

Other vulnerabilities in pnpm

• CVE-2026-50016 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement High 8.8
• CVE-2026-55698 pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes High 8.8
• CVE-2025-69264 pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default" High 8.8
• CVE-2022-26183 Untrusted Search Path in PNPM High 8.8
• CVE-2026-59195 pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5r98-f33j-g8h7.