AdmZip's Utils.writeFileTo opens each destination with fs.openSync(path,
"w"), which resolves symlinks, and Utils.sanitize only compares the entry
name as a string against the extraction root (GHSA-vwc7-r8mq-g2x9). A
symlink that already exists at a destination therefore redirects the write
anywhere the process can write. No patched adm-zip release exists.
extractZipToTarget extracted prefixed archives into path.dirname(targetDir),
which is the store's shared tmp directory, so every entry landed at the
fixed path <store>/tmp/<prefix>/... Node.js on Windows and Bun on every
platform set a prefix; Deno does not and already extracted into the random
directory from cafs.tempDir(). On a store shared by several users, another
user could pre-create a symlink at that fixed path and have pnpm overwrite
an arbitrary file. pnpm's own validatePathSecurity does not help: it checks
the entry string, which is exactly the check the advisory calls
insufficient.
Extract into a directory created with mkdtemp next to targetDir instead,
on the same filesystem so the rename stays cheap, and remove it afterwards.
That leaves no predictable destination to plant a link at, independent of
what adm-zip does.
The advisory is added to auditConfig.ignoreGhsas since no upgrade exists.
Zoltan Kochan
8cd45fdf36