Vulnerability · Published Jun 25, 2026 · Assigned by GitHub_M

CVE-2026-50014pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

Medium 6.4

In plain English

A medium-severity argument injection in pnpm from pnpm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.3%top 75.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm passes the lockfile-controlled git resolution.commit value to git fetch without a -- separator or commit-format validation. For git dependencies fetched through the shallow-fetch path, a malicious lockfile can replace the expected 40-character commit hash with a Git option such as --upload-pack=<command>. For SSH and local transports, --upload-pack can execute the supplied command. HTTPS transports ignore --upload-pack, so the practical attack surface is primarily SSH or local git dependencies. This vulnerability is fixed in 10.34.0 and 11.4.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	pnpm	10.34.0	GHSA-p4xf-rf54-rj3x
npm	pnpm	11.4.0	GHSA-p4xf-rf54-rj3x

Affected products (as reported)

Vendor	Product	Versions
pnpm	pnpm	< 10.33.4>= 11.0.0, < 11.4.0

Weakness: CWE-88 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

References

https://github.com/pnpm/pnpm/security/advisories/GHSA-p4xf-rf54-rj3x x_refsource_CONFIRM