p PatchFirst

PatchFirst · Latest vulnerabilities

pnpm vulnerabilities

Vulnerabilities published for pnpm in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 32

  1. CVE-2026-101043

    High · CVSS 8.3EPSS 0.22%Fix available

    pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings

    pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the request-destination key set that otherwise suppresses placeholder expansion for untrusted manifests (as already done for registry, pnprServer, registries and namedRegistries), an attacker who controls a repository's pnpm-workspace.yaml can cause a victim who clones the repository and runs a pnpm command (e.g. pnpm install) to expand environment secrets such

    pnpm pnpmNode.js
    • Update to 10.34.5
    • Update to 11.11.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. GHSA-2rx9-3g3h-c2jv

    High · CVSS 7.1Fix available

    pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

    ## Summary A crafted lockfile alias could reach several install-time filesystem joins. With `--trust-lockfile` or a frozen lockfile, traversal segments could create links outside the intended project or `node_modules` boundary. This patch validates dependency names and every virtual-store slot before creating directories, links, bins, or hoisted entries. ## Security boundary - A shared safe-join helper rejects traversal, absolute, platform-specific, and reserved dependency names before filesystem materialization. - Direct and transitive dependency links, package links, bin destinations, and public/private hoist destinations use the same co

    pnpmNode.js
    • Update to 12.0.0-alpha.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-82393

    High · CVSS 7.5EPSS 0.63%Fix available

    pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

    pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name reaches raw path joins in pnpm11/installing/deps-resolver/src/resolvePeers.ts, pnpm11/installing/deps-resolver/src/index.ts, and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts, causing package extraction outside node_modules and allowing attacker-controlled files to overwrite arbitrary filesystem paths even when --ignore-scripts is used. The overw

    pnpm pnpmNode.js
    • Update to 10.34.5
    • Update to 11.11.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2026-82392

    High · CVSS 7.1EPSS 0.61%Fix available

    pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

    pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parse(depPath).name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts. The name reaches path.join(modules, pkgName), storeController.importPackage, and pnpm11/lockfile/to-pnp/src/index.ts, allowing package contents to be written outside node_modules when a user runs pnpm install. When dangerouslyAllowAllBuilds or a matching allowBuilds entry permits lifecycle scripts, the escaped package can exec

    pnpm pnpmNode.js
    • Update to 10.34.5
    • Update to 11.11.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2026-59195

    High · CVSS 8.2EPSS 0.4%Fix available

    pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

    pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those names directly when creating config dependency symlinks under node_modules/.pnpm-config. A malicious repository can commit a crafted pnpm-lock.yaml whose env-lockfile document contains a traversal-shaped config dependency name. During pnpm install, pnpm installs the config dependency and creates a symlink at a path derived from that name. This vulnerability is fixed in 10.34.4 and 11.8.0.

    pnpm pnpmNode.js
    • Update to 10.34.4
    • Update to 11.8.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2026-59196

    High · CVSS 7.1EPSS 0.4%Fix available

    pnpm: hoisted install imports lockfile alias outside node_modules

    pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined directly under a hoisted node_modules directory. Traversal aliases could escape that directory, while reserved aliases such as .bin or .pnpm could overwrite pnpm-owned layout. This vulnerability is fixed in 10.34.4 and 11.7.0.

    pnpm pnpmNode.js
    • Update to 10.34.4
    • Update to 11.7.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2026-59194

    High · CVSS 7.1EPSS 0.4%Fix available

    pnpm: patch-remove could delete project-selected files outside the patches directory

    pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory and cause pnpm patch-remove to delete an arbitrary reachable file. This vulnerability is fixed in 10.34.4 and 11.7.0.

    pnpm pnpmNode.js
    • Update to 10.34.4
    • Update to 11.7.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. CVE-2026-55180

    Medium · CVSS 6.5EPSS 0.37%Fix available

    pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

    pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace.yaml into registry request destinations and registry credentials. A malicious repository could cause dependency resolution to send victim environment secrets to an attacker-selected registry before lifecycle scripts run. This vulnerability is fixed in 10.34.2 and 11.5.3.

    pnpm pnpmNode.js
    • Update to 10.34.2
    • Update to 11.5.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. CVE-2026-48995

    Medium · CVSS 4.8EPSS 0.17%Fix available

    pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

    pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. The lockfile does not store the hash of the dependencies from https://codeload.github.com. This means that if this server was compromised or a person's machine configuration was compromised, pnpm would download and install these dependencies. This vulnerability is fixed in 10.33.4 and 11.0.7.

    pnpm pnpmNode.js
    • Update to 10.33.4
    • Update to 11.0.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  10. CVE-2026-50017

    Medium · CVSS 6.9EPSS 0.44%Fix available

    pnpm binds unscoped user-level npm auth credentials to a repository-selected registry

    pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local .npmrc file. In the reproduced case, the user's npm config contains a default registry and an unscoped _authToken. The repository does not provide a token-bearing auth line. It only sets registry= to a different registry URL. During normal pnpm metadata/install workflows, pnpm binds the user-origin unscoped credential to the repository-selected registry and sends it as an Authorization header. This vulnerability is fixed in 10.34.0 and 11.4.0.

    pnpm pnpmNode.js
    • Update to 10.34.0
    • Update to 11.4.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  11. CVE-2026-50016

    High · CVSS 8.8EPSS 0.53%Fix available

    pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

    pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause `pnpm install --ignore-scripts` to replace paths in the current project with symlinks to attacker-controlled dependency package directories. This vulnerability is fixed in 10.34.0 and 11.4.0.

    pnpm pnpmNode.js
    • Update to 10.34.0
    • Update to 11.4.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  12. CVE-2026-50015

    High · CVSS 7.3EPSS 0.43%Fix available

    pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

    pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's patch application pipeline (@pnpm/patch-package) performs no path validation on file paths extracted from .patch files. An attacker who contributes a malicious patch file via a pull request can write attacker-controlled content to or delete arbitrary files on the filesystem during pnpm install, as the user running the install. The diff --git header paths containing ../../ sequences traverse out of the package directory, and the traversal is difficult to catch in code review because patch file diff headers are opaque to most reviewers. This vulnerability is fixed in 10.34.0 and 11.

    pnpm pnpmNode.js
    • Update to 10.34.0
    • Update to 11.4.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  13. CVE-2026-50014

    Medium · CVSS 6.4EPSS 0.32%Fix available

    pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

    pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm passes the lockfile-controlled git resolution.commit value to git fetch without a -- separator or commit-format validation. For git dependencies fetched through the shallow-fetch path, a malicious lockfile can replace the expected 40-character commit hash with a Git option such as --upload-pack=<command>. For SSH and local transports, --upload-pack can execute the supplied command. HTTPS transports ignore --upload-pack, so the practical attack surface is primarily SSH or local git dependencies. This vulnerability is fixed in 10.34.0 and 11.4.0.

    pnpm pnpmNode.js
    • Update to 10.34.0
    • Update to 11.4.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  14. CVE-2026-50573

    Medium · CVSS 6.8EPSS 0.17%Fix available

    pnpm: Unsafe default behavior breaks integrity check

    pnpm is a package manager. Prior to 10.34.0 and 11.4.0, `pnpm install` in non-frozen mode can accept new remote package content after detecting that the downloaded tarball does not match the integrity recorded in pnpm-lock.yaml. When a package is already locked with an integrity value, and the registry later serves different metadata and tarball content for the same package name and version, pnpm initially reports an integrity mismatch. However, plain pnpm install then performs a resolution repair, accepts the registry's new integrity, updates the lockfile, installs the new content, and exits successfully. This means the lockfile integrity ch

    pnpm pnpmNode.js
    • Update to 10.34.0
    • Update to 11.4.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  15. CVE-2026-50021

    Medium · CVSS 6.8EPSS 0.18%Fix available

    pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field

    pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's tarball extraction worker skips integrity verification when the integrity field is absent from the lockfile resolution. If an attacker can both modify pnpm-lock.yaml to remove the integrity: field and cause the referenced registry URL to serve altered package content, pnpm install --frozen-lockfile can install the altered package without an integrity error. npm's npm ci enforces integrity by default; pnpm's behavior of silently skipping verification is a pnpm-specific fail-open gap. This vulnerability is fixed in 10.34.0 and 11.4.0.

    pnpm pnpmNode.js
    • Update to 10.34.1
    • Update to 11.4.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  16. CVE-2026-55700

    High · CVSS 7.1EPSS 0.42%Fix available

    pnpm: stage download writes outside destination via manifest version traversal

    pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file. The merged fix validates both fields, derives one safe filename, and verifies the final destination before writing. This vulnerability is fixed in 11.5.3.

    pnpmNode.js
    • Update to 11.5.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2026-55699

    Medium · CVSS 6.5EPSS 0.45%Fix available

    pnpm: reserved bin name deletes PNPM_HOME during global remove

    pnpm is a package manager. Prior to 10.34.2 and 11.5.3, Manifest bin object keys such as "", ".", and ".." passed pnpm's bin-name guard. When a malicious package was installed globally, later global remove, update, or add-replacement flows could re-derive those names from the installed manifest and pass path.join(globalBinDir, binName) to removeBin. For "." this targets the global bin directory; for ".." this targets its parent. This vulnerability is fixed in 10.34.2 and 11.5.3.

    pnpm pnpmNode.js
    • Update to 10.34.2
    • Update to 11.5.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  18. CVE-2026-55698

    High · CVSS 8.8EPSS 0.3%Fix available

    pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

    pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pnpm-lock.yaml. Before the patch, direct pnpm execution trusted an already resolved packageManagerDependencies entry when the committed env lockfile contained matching pnpm and @pnpm/exe versions. A malicious repository could therefore commit package-manager lockfile package records and snapshots that bypassed fresh package-manager resolution, then cause pnpm to install and execute bytes selected by that committed lockfile state during automatic version switching. This vulnerability is fixed in 10.34.2 and

    pnpm pnpmNode.js
    • Update to 10.34.2
    • Update to 11.5.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  19. CVE-2026-55697

    High · CVSS 7.5EPSS 0.19%Fix available

    pnpm: Repository-controlled configDependencies can select a pacquet native install engine

    pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command dispatch. Before the patch, a repository could declare pacquet or @pnpm/pacquet as a config dependency and pnpm treated that repository-controlled dependency as an install-engine opt-in. During install, pnpm resolved a platform-specific @pacquet/<platform>-<arch>/pacquet binary from node_modules/.pnpm-config/<packageName> and spawned it as the developer or CI user. This vulnerability is fixed in 10.34.2 and 11.5.3.

    pnpm pnpmNode.js
    • Update to 10.34.2
    • Update to 11.5.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  20. CVE-2026-55487

    High · CVSS 7.5EPSS 0.18%Fix available

    pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

    pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stripped parenthesized text from git, URL, tarball, file, and other opaque locators. Approval for one source string could therefore authorize a different attacker-controlled source whose locator normalized to the same value. This vulnerability is fixed in 10.34.2 and 11.5.3.

    pnpm pnpmNode.js
    • Update to 10.34.2
    • Update to 11.5.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →