Multiple Vulnerabilities Detected in Popular Package Managers

Security vulnerabilities have been detected in popular package managers, allowing threat actors to execute arbitrary code on the target system and access sensitive data. Package managers are tools that enable easy installation, updating, and configuration of third-party dependencies required by applications.

The detected security vulnerabilities are in the following package managers;
• Composer
• Bundler
• Bower
• Poetry
• Yarn
• pnpm
• Pip
• Pipenv

The vulnerability found in Composer and tracked with code CVE-2021-41116 is a Command Injection vulnerability that could allow remote threat actors to execute arbitrary commands on the target system. Argument Injection and Untrusted Search Path security vulnerabilities found in Bundler, Poetry, Yarn, Pip, and Pipenv can allow threat actors to execute arbitrary code on the target system via malware-laden Git or Gemfiles files.

The package managers fixed the vulnerabilities that were foreseen to be used in supply chain attacks shortly after the announcement. However, the Untrusted Search Path vulnerability affecting three package managers, Composer, Pip, and Pipenv, is still not fixed. In this context, it is recommended that users using vulnerable package manager versions immediately upgrade to the published updates in order not to be the target of attacks that can be carried out using vulnerabilities.