A vulnerability in aiohttp's CookieJar persistence causes host-only cookies saved and later restored to lose their host-only status. This results in cookies being sent to subdomains that should not receive them, potentially exposing sensitive session data. The issue affects versions of vdirsyncer from 0.19.0 up to but not including 0.20.0_7. A patch is available in version 0.20.0_7 to address this behavior.
pnpm version 9 contains a path traversal vulnerability in handling the 'directories.bin' field of package manifests. This flaw allows a malicious npm package to specify a relative path that escapes the package root directory, causing pnpm to change file permissions (chmod 755) on arbitrary files outside the package directory on Unix-like systems. Windows is not affected. The vulnerability arises because the path is joined without validation to ensure it remains within the package directory.
pnpm version 9.15.4 and later has a vulnerability where it follows symlinks in file: and git: dependencies without restricting access to the package root. This can lead to local file disclosure if a malicious package includes symlinks to sensitive files such as /etc/passwd or SSH keys. The issue does not affect registry packages published to npm, as symlinks are stripped there. The vulnerability has a CVSS score of 6.5 (medium severity).
A path traversal vulnerability in pnpm version 9.15.4 and later allows malicious npm packages to create executable shims or symlinks outside the intended node_modules/.bin directory. This occurs because bin names starting with '@' bypass validation and path traversal sequences are preserved after normalization, enabling arbitrary file creation outside the expected directory.
A path traversal vulnerability in pnpm version 9.15.4 and later on Windows allows malicious tarballs to write files outside the intended package directory. This occurs because the path normalization only checks for './' but not for Windows-style backslashes '\\', enabling attackers to escape the package directory and overwrite files such as .npmrc. The issue is specific to Windows due to its use of backslashes as directory separators.
A path traversal vulnerability in pnpm's binary fetcher allows malicious ZIP archives or crafted extraction prefixes to write files outside the intended directory. This can lead to overwriting sensitive files such as configuration files. The flaw arises from AdmZip's extractAllTo method not validating ZIP entry paths and from unvalidated prefix concatenation in the extraction path. The vulnerability affects pnpm versions 9.15.4 and later. The CVSS score is 6.5 (medium severity).
pnpm version 9 has a vulnerability where HTTP and git-hosted tarball dependencies are stored in the lockfile without integrity hashes. This allows a remote server to serve different content on each install despite a committed lockfile, enabling dynamic dependency manipulation. The issue affects HTTP/HTTPS tarball URLs and git dependencies but not npm registry packages. An attacker can exploit this to serve varying malicious payloads, evading audits and targeting specific users or environments.
A command injection vulnerability (CVE-2025-69262) exists in pnpm version 9.15.4 and later when using environment variable substitution in .npmrc files with tokenHelper settings. An attacker controlling environment variables can execute arbitrary code during pnpm operations, particularly in build environments such as CI/CD pipelines, Docker builds, and Kubernetes deployments. The vulnerability arises from spawning a helper script with shell execution without sufficient validation. The CVSS score is 7.5 (High).
The pydantic-settings library's NestedSecretsSettingsSource component improperly follows symbolic links inside a configured secrets directory that point outside this directory, allowing local files outside the intended secrets directory to be read into application settings. This behavior also bypasses the configured maximum size limit for secrets directories, potentially leading to resource exhaustion. The vulnerability requires the ability to place symlinks inside the secrets directory and is not remotely exploitable by itself. It affects versions from 0.10.0_2 up to but not including 0.12.0_3. A fix is available in version 0.12.0_3.
Starlette's request.form() method does not enforce configured limits on max_fields and max_part_size for application/x-www-form-urlencoded content types, allowing an attacker to send requests with an arbitrarily large number of fields or very large fields. This can cause denial of service by blocking the event loop or exhausting memory. The issue affects versions from 0.8.2 up to but not including 0.12.0_2. A patch is available in version 0.12.0_2 that enforces these limits for url-encoded bodies.