Pnpm vulnerabilities

Products

• Pnpm 32

Newest

• pnpm pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias CVE-2026-101044 7.1 HighSeptember 27, 2026
• pnpm pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings CVE-2026-101043 Fix available 8.3 HighSeptember 1, 2026
• pnpm pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install CVE-2026-82393 Fix available 7.5 HighAugust 31, 2026
• pnpm pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph CVE-2026-82392 Fix available 7.1 HighAugust 31, 2026
• pnpm pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config CVE-2026-59195 Fix available 8.2 HighJune 27, 2026
• pnpm pnpm: patch-remove could delete project-selected files outside the patches directory CVE-2026-59194 Fix available 7.1 HighJune 27, 2026
• pnpm pnpm: hoisted install imports lockfile alias outside node_modules CVE-2026-59196 Fix available 7.1 HighJune 27, 2026
• pnpm pnpm: Repository config can expand victim environment secrets into registry requests before scripts run CVE-2026-55180 Fix available 6.5 MediumJune 25, 2026
• pnpm pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile CVE-2026-48995 Fix available 4.8 MediumJune 25, 2026
• pnpm pnpm binds unscoped user-level npm auth credentials to a repository-selected registry CVE-2026-50017 Fix available 6.9 MediumJune 25, 2026
• pnpm pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement CVE-2026-50016 Fix available 8.8 HighJune 25, 2026
• pnpm pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal) CVE-2026-50015 Fix available 7.3 HighJune 25, 2026
• pnpm pnpm: Git Fetch Argument Injection via Lockfile resolution.commit CVE-2026-50014 Fix available 6.4 MediumJune 25, 2026
• pnpm pnpm: Unsafe default behavior breaks integrity check CVE-2026-50573 Fix available 6.8 MediumJune 25, 2026
• pnpm pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field CVE-2026-50021 Fix available 6.8 MediumJune 25, 2026
• pnpm pnpm: stage download writes outside destination via manifest version traversal CVE-2026-55700 Fix available 7.1 HighJune 25, 2026
• pnpm pnpm: reserved bin name deletes PNPM_HOME during global remove CVE-2026-55699 Fix available 6.5 MediumJune 25, 2026
• pnpm pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes CVE-2026-55698 Fix available 8.8 HighJune 25, 2026
• pnpm pnpm: Repository-controlled configDependencies can select a pacquet native install engine CVE-2026-55697 Fix available 7.5 HighJune 25, 2026
• pnpm pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle CVE-2026-55487 Fix available 7.5 HighJune 25, 2026
• pnpm pnpm has Path Traversal via arbitrary file permission modification CVE-2026-24131 Fix available 6.7 MediumJanuary 26, 2026
• pnpm pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip) CVE-2026-23888 Fix available 6.5 MediumJanuary 26, 2026
• pnpm pnpm has Windows-specific tarball Path Traversal CVE-2026-23889 Fix available 6.5 MediumJanuary 26, 2026
• pnpm pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin CVE-2026-23890 Fix available 6.5 MediumJanuary 26, 2026
• pnpm pnpm has symlink traversal in file:/git dependencies CVE-2026-24056 Fix available 6.7 MediumJanuary 26, 2026
• pnpm, red hat jboss enterprise application platform 8, jboss enterprise application platform expansion pack +2 more pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default" CVE-2025-69264 Fix available 8.8 HighJanuary 7, 2026
• pnpm, red hat jboss enterprise application platform 8, jboss enterprise application platform expansion pack +2 more pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies CVE-2025-69263 Fix available 7.5 HighJanuary 7, 2026
• pnpm pnpm vulnerable to Command Injection via environment variable substitution CVE-2025-69262 Fix available 7.6 HighJanuary 7, 2026
• pnpm pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting CVE-2024-47829 Fix available 6.5 MediumApril 23, 2025
• pnpm pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion CVE-2024-53866 Fix available 5.8 MediumDecember 10, 2024
• pnpm pnpm incorrectly parses tar archives relative to specification CVE-2023-37478 Public exploitFix available 7.5 HighAugust 1, 2023
• pnpm Untrusted Search Path in PNPM CVE-2022-26183 Fix available 8.8 HighMarch 21, 2022