pnpm

Products

Exploited and recent CVEs

• CVE-2026-101044 High 7.1 pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias 0.3%
• CVE-2026-101043 High 7.4 pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings 0.3%
• CVE-2026-82393 High 7.5 pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install 0.6%
• CVE-2026-82392 High 7.1 pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph 0.6%
• CVE-2026-59195 High 8.2 pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config 0.4%
• CVE-2026-59196 High 7.1 pnpm: hoisted install imports lockfile alias outside node_modules 0.4%
• CVE-2026-59194 High 7.1 pnpm: patch-remove could delete project-selected files outside the patches directory 0.4%
• CVE-2026-55180 Medium 6.5 pnpm: Repository config can expand victim environment secrets into registry requests before scripts run 0.4%
• CVE-2026-48995 Medium 4.8 pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile 0.2%
• CVE-2026-50017 Medium 6.9 pnpm binds unscoped user-level npm auth credentials to a repository-selected registry 0.4%
• CVE-2026-50016 High 8.8 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement 0.5%
• CVE-2026-50015 High 7.3 pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal) 0.4%
• CVE-2026-50014 Medium 6.4 pnpm: Git Fetch Argument Injection via Lockfile resolution.commit 0.3%
• CVE-2026-50573 Medium 6.8 pnpm: Unsafe default behavior breaks integrity check 0.2%
• CVE-2026-50021 Medium 6.8 pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field 0.2%
• CVE-2026-55700 High 7.1 pnpm: stage download writes outside destination via manifest version traversal 0.4%
• CVE-2026-55699 Medium 6.5 pnpm: reserved bin name deletes PNPM_HOME during global remove 0.4%
• CVE-2026-55698 High 8.8 pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes 0.3%
• CVE-2026-55697 High 7.5 pnpm: Repository-controlled configDependencies can select a pacquet native install engine 0.2%
• CVE-2026-55487 High 7.5 pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle 0.2%
• CVE-2026-24131 Medium 6.7 pnpm has Path Traversal via arbitrary file permission modification 0.3%
• CVE-2026-24056 Medium 6.7 pnpm has symlink traversal in file:/git dependencies 0.5%
• CVE-2026-23890 Medium 6.5 pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin 0.5%
• CVE-2026-23889 Medium 6.5 pnpm has Windows-specific tarball Path Traversal 0.5%
• CVE-2026-23888 Medium 6.5 pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip) 0.4%
• CVE-2025-69262 High 7.6 pnpm vulnerable to Command Injection via environment variable substitution 1.0%
• CVE-2025-69264 High 8.8 pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default" 1.0%
• CVE-2025-69263 High 7.5 pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies 0.5%
• CVE-2024-47829 Medium 6.5 pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting 0.2%
• CVE-2024-53866 Medium 5.8 pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion 1.0%