CVE-2022-26183 (JSON, published 2022-03-21T22:15Z)
Description: value: PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-426 \u2014 Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Repository: https://github.com/pnpm/pnpm
Files changed:
.changeset/sweet-insects-carry.md
packages/beta/package.json
packages/beta/scripts/build-artifacts.ts
packages/filter-workspace-packages/package.json
packages/git-fetcher/package.json
packages/git-resolver/package.json
packages/plugin-commands-env/package.json
packages/plugin-commands-env/test/env.test.ts
packages/plugin-commands-listing/package.json
packages/plugin-commands-publishing/package.json
packages/plugin-commands-rebuild/package.json
packages/plugin-commands-script-runners/package.json
packages/plugin-commands-script-runners/test/dlx.ts
packages/plugin-commands-script-runners/test/runRecursive.ts
packages/plugin-commands-setup/package.json
packages/plugin-commands-store/package.json
packages/pnpm/package.json
packages/prepare-package/package.json
packages/supi/package.json
pnpm-lock.yaml
utils/scripts/package.json
utils/scripts/src/copy-artifacts.ts
Commit message: fix: prevent binary planting attacks on Windows


Vulnerable code:
    "execa": "^5.0.0"
import execa from 'execa'
    "execa": "^5.0.0",
    "execa": "^5.0.0"
    "graceful-git": "^3.0.2",
    "execa": "^5.0.0",
import execa from 'execa'
    "execa": "^5.0.0",
    "execa": "^5.0.0",
    "execa": "^5.0.0",
    "execa": "^5.0.0",
  await dlx.handler({}, ['touch', 'foo'])
  await execa('pnpm', [
  await execa('pnpm', [
  await execa('pnpm', [
  await execa('pnpm', [
  await execa('pnpm', [
  await execa('pnpm', [
  await execa('pnpm', [
  await execa('pnpm', [
  await execa('pnpm', [
    "execa": "^5.0.0",
    "execa": "^5.0.0",
    "execa": "^5.0.0",
    "execa": "^5.0.0",
    "execa": "^5.0.0",
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      graceful-git: ^3.0.2
      graceful-git: 3.0.2
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
  /@pnpm/cli-utils/0.6.17_@pnpm+logger@4.0.0:
    resolution: {integrity: sha512-4zsKAifcdt8rf66+GE6tpLwTwdPLU9TfeTxSbHSzqZwnFhCxUCN0FzuI+vv7RUOaxTS9D1wcTHIjtoqJCUbb4g==}
      '@pnpm/config': 12.4.7
      '@pnpm/default-reporter': 8.1.12_@pnpm+logger@4.0.0
  /@pnpm/config/12.4.7:
    resolution: {integrity: sha512-Y0yE/lYzJyNGdZFjmc1lzk/tECG+XRXi0CAVrroJIbwrCspmtuoLewSbujXj/49G2Eti0p520/OuWI9o/xbvgg==}
      '@pnpm/global-bin-dir': 2.0.0
  /@pnpm/default-reporter/8.1.12_@pnpm+logger@4.0.0:
    resolution: {integrity: sha512-ZSgH5yyGKmRkJLfFHJ4ptxoNiUrLhEUxh9Ff67s978D97/DEWdg/DjwFx5TToCvPW9l7cT5Zo0nP+npbvmdQjQ==}
      '@pnpm/config': 12.4.7
      boxen: 5.0.1
  /@pnpm/find-workspace-packages/3.1.9_@pnpm+logger@4.0.0:
    resolution: {integrity: sha512-N2xJqnux0cFhyvWxxE0oO0b26xJa0GyfsZI0qBVjzUb9m5kpPPahmSqYIECQTWmEfhxQeqbvgyTsVfmUmLV99A==}
      '@pnpm/cli-utils': 0.6.17_@pnpm+logger@4.0.0
  /@pnpm/global-bin-dir/2.0.0:
    resolution: {integrity: sha512-TNV0RbtiNx/NfiB8iJfttySUwiadJx2kQb/yHbaCAXx3KGOKSgfA2mh+Lr4o40wIgOx7ROuoKZ0iVxYfq0jevA==}
      '@pnpm/find-workspace-packages': 3.1.9_@pnpm+logger@4.0.0
      signal-exit: 3.0.3
  /graceful-git/3.0.2:
    resolution: {integrity: sha512-fZ5zG+uT3zRqpRU7kXEUQkbRfIK66JRLfV528Glm703gr/qVfF0zppqC4ksuO1fLmlxBNAxLqQUfhF/vAriMtQ==}
      execa: 5.1.1
      uglify-js: 3.14.1
  /uglify-js/3.14.1:
    resolution: {integrity: sha512-JhS3hmcVaXlp/xSo3PKY5R0JqKs5M3IV+exdLHW99qKvKivPO4Z8qbej6mte17SOPqAOVMjt/XGgWacnFSzM3g==}
    "execa": "^5.0.0",
import execa from 'execa'

Fixed code:
---
"@pnpm/filter-workspace-packages": patch
"@pnpm/git-fetcher": patch
"@pnpm/git-resolver": patch
"@pnpm/plugin-commands-publishing": patch
"@pnpm/plugin-commands-script-runners": patch
"@pnpm/plugin-commands-setup": patch
---

Use safe-execa instead of execa to prevent binary planting attacks on Windows.
    "execa": "npm:safe-execa@^0.1.1"
import * as execa from 'execa'
    "execa": "npm:safe-execa@^0.1.1",
    "execa": "npm:safe-execa@^0.1.1"
    "graceful-git": "^3.1.2",
    "execa": "npm:safe-execa@^0.1.1",
import * as execa from 'execa'
    "execa": "npm:safe-execa@^0.1.1",
    "execa": "npm:safe-execa@^0.1.1",
    "execa": "npm:safe-execa@^0.1.1",
    "execa": "npm:safe-execa@^0.1.1",
  await dlx.handler({}, ['shx', 'touch', 'foo'])
  await execa(pnpmBin, [
  await execa(pnpmBin, [
  await execa(pnpmBin, [
  await execa(pnpmBin, [
  await execa(pnpmBin, [
  await execa(pnpmBin, [
  await execa(pnpmBin, [
  await execa(pnpmBin, [
  await execa(pnpmBin, [
    "execa": "npm:safe-execa@^0.1.1",
    "execa": "npm:safe-execa@^0.1.1",
    "execa": "npm:safe-execa@^0.1.1",
    "execa": "npm:safe-execa@^0.1.1",
    "execa": "npm:safe-execa@^0.1.1",
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      graceful-git: ^3.1.2
      graceful-git: 3.1.2
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
  /@pnpm/cli-utils/0.6.21_@pnpm+logger@4.0.0:
    resolution: {integrity: sha512-G0/YvHfNB+umbrEwJz6Pmd6GMxpm1xDsSeGaEu/aM/Ex31OzhiSZ8XOaIQiU160he/z3kGs9ySOPZDxhRJeLcQ==}
      '@pnpm/config': 12.5.0
      '@pnpm/default-reporter': 8.2.1_@pnpm+logger@4.0.0
  /@pnpm/config/12.5.0:
    resolution: {integrity: sha512-xN+rCE0JkOu5rxgIGRUjpunJB1tn6SzINp7eLyat0v+slpuccweXIoPYKUt6QTDjJR2CRJHrWZ9lfG+zA8BYuQ==}
      '@pnpm/global-bin-dir': 3.0.0
  /@pnpm/default-reporter/8.2.1_@pnpm+logger@4.0.0:
    resolution: {integrity: sha512-4yusyK4dGyk8kDJaVP1yCdsgSJnB7lS/9BSXLVh0iD2hrOwEMBKO6yBhEynuOVBYbGTcWxZ9BahnFMvrQGAS+w==}
      '@pnpm/config': 12.5.0
      boxen: 5.1.1
  /@pnpm/find-workspace-packages/3.1.13_@pnpm+logger@4.0.0:
    resolution: {integrity: sha512-WqqmNhlIv7utYie+gIAmho23bFPehKT08o2Jkg2n79Tz9rRCxXxyKqaPaUPObamClTgqDrZPEGVTxx7wbeOBpA==}
      '@pnpm/cli-utils': 0.6.21_@pnpm+logger@4.0.0
  /@pnpm/global-bin-dir/3.0.0:
    resolution: {integrity: sha512-48Hw1JGftIO84o41Pm1+1kIulnFL0ca5VGPIQ+A1q1l3IVlxp2LnCX3424p+XIGG54US4pEQ7kMQaXhZBEBqbQ==}
      '@pnpm/find-workspace-packages': 3.1.13_@pnpm+logger@4.0.0
  /@zkochan/which/2.0.3:
    resolution: {integrity: sha512-C1ReN7vt2/2O0fyTsx5xnbQuxBrmG5NMSbcIkPKCCfCTJgpZBsuRYzFXHj3nVq8vTfK7vxHUmzfCpSHgO7j4rg==}
    engines: {node: '>= 8'}
    hasBin: true
    dependencies:
      isexe: 2.0.0

    dev: false

  /boxen/5.1.1:
    resolution: {integrity: sha512-JtIQYts08AFAYGF4eSh3pUt3NQkYV/e75pRtQmAVTLNWR/1L7Bsswxlgzgk8nmLEM+gFszsIlA9BgD3XnSqp3g==}
    engines: {node: '>=10'}
    dependencies:
      ansi-align: 3.0.0
      camelcase: 6.2.0
      chalk: 4.1.2
      cli-boxes: 2.2.1
      string-width: 4.2.2
      type-fest: 0.20.2
      widest-line: 3.1.0
      wrap-ansi: 7.0.0
    dev: true
      signal-exit: 3.0.4
  /graceful-git/3.1.2:
    resolution: {integrity: sha512-Xyh9Y43yA23/KQ16mpwO4zkzVGUAXyzuSVZQxw9ddQklssIYIY0el24VYfJBFhyCWGriZPRAB2nCgsDizqna9g==}
      safe-execa: 0.1.1
      uglify-js: 3.14.2
  /safe-execa/0.1.1:
    resolution: {integrity: sha512-2KPID7iC4AMoJVozDPtcLGV+7LdpE0sR1hPkJUCaEnRsiYSZH2wgOFvxZ9UOtj1r8hNk8pVWn1tgmaEyyFZ4NA==}
    engines: {node: '>=12'}
    dependencies:
      '@zkochan/which': 2.0.3
      execa: 5.1.1
      path-name: 1.0.0

  /signal-exit/3.0.4:
    resolution: {integrity: sha512-rqYhcAnZ6d/vTPGghdrw7iumdcbXpsk1b8IG/rz+VWV51DM0p7XCtMoJ3qhPLIbp3tvyt3pKRbaaEMZYpHto8Q==}

  /uglify-js/3.14.2:
    resolution: {integrity: sha512-rtPMlmcO4agTUfz10CbgJ1k6UAoXM2gWb3GoMPPZB/+/Ackf8lNWk11K4rYi2D0apgoFRLtQOZhb+/iGNJq26A==}
    "execa": "npm:safe-execa@^0.1.1",
import * as execa from 'execa'