SB2026052527 - Multiple vulnerabilities in pnpm

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026052527

SB2026052527 - Multiple vulnerabilities in pnpm

Published: May 25, 2026 Updated: June 23, 2026

Security Bulletin ID SB2026052527
CSH Severity
High
Patch available
YES
Number of vulnerabilities 15
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 40% Low 27%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 15 vulnerabilities.


1) Missing support for integrity check (CVE-ID: CVE-2026-48995)

CWE-ID: CWE-353 - Missing Support for Integrity Check

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper integrity verification in the lockfile handling for GitHub git dependencies when downloading tarballs from codeload.github.com. A remote attacker can serve a malicious tarball to execute arbitrary code.

Only dependencies fetched from GitHub via codeload.github.com are affected because the lockfile does not store their tarball hash.


2) Insufficient verification of data authenticity (CVE-ID: CVE-2026-50573)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to install altered package content and compromise integrity protections.

The vulnerability exists due to insufficient verification of data authenticity in pnpm install when processing package downloads whose tarball integrity does not match the value recorded in pnpm-lock.yaml during non-frozen installation. A remote attacker can serve modified package metadata and tarball content for an existing package version to install altered package content and compromise integrity protections.

User interaction is required to run a non-frozen install in a new or clean environment, and the issue does not occur in frozen-lockfile mode.


3) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-50014)

CWE-ID: CWE-88 - Argument Injection or Modification

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of argument delimiters in the git fetcher when processing a lockfile-controlled git commit value during shallow fetching of git dependencies. A remote user can supply a specially crafted pnpm lockfile value to inject git options and execute arbitrary code.

Exploitation requires user interaction to run pnpm install, and the affected dependency must use SSH or local git transport because HTTPS transport ignores the relevant git option.


4) Improper validation of integrity check value (CVE-ID: CVE-2026-50021)

CWE-ID: CWE-354 - Improper Validation of Integrity Check Value

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to install altered package content without an integrity error.

The vulnerability exists due to improper validation of integrity check value in the tarball extraction worker when processing lockfile resolutions that omit the integrity field. A remote user can modify pnpm-lock.yaml to remove the integrity field and cause the referenced registry URL to serve altered package content to install altered package content without an integrity error.

The issue affects pnpm install with --frozen-lockfile because integrity verification is silently skipped when the lockfile entry lacks an integrity value.


5) Path traversal (CVE-ID: CVE-2026-50015)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to write or delete arbitrary files.

The vulnerability exists due to path traversal in the @pnpm/patch-package patch application pipeline when processing a crafted .patch file during pnpm install. A remote user can submit a malicious patch file and patchedDependencies configuration to write or delete arbitrary files.

User interaction is required to run pnpm install on a workspace containing the malicious patch configuration.


6) Relative Path Traversal (CVE-ID: CVE-2026-50016)

CWE-ID: CWE-23 - Relative Path Traversal

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to relative path traversal in dependency linking logic when processing transitive dependency aliases from registry package metadata during installation. A remote attacker can publish a specially crafted package dependency chain to execute arbitrary code.

User interaction is required to install a package and later run a normal project or CI command that consumes a replaced project-local path.


7) Insufficiently protected credentials (CVE-ID: CVE-2026-50017)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to insufficiently protected credentials in pnpm auth-header handling when processing repository-local .npmrc registry configuration during install or metadata requests. A remote user can provide a repository with a crafted .npmrc that selects an attacker-controlled registry to disclose sensitive information.

The issue can expose user-level unscoped npm credentials in Authorization headers before package lifecycle scripts run and does not depend on package code execution.


8) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-55180)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into sent data in repository-controlled .npmrc and pnpm-workspace.yaml registry and auth configuration handling when processing environment variable placeholders in registry request destinations and credential values. A remote attacker can trick the victim into running a dependency-management command in a malicious repository to disclose sensitive information.

User interaction is required, and the disclosure can occur before lifecycle scripts run.


9) Origin validation error (CVE-ID: CVE-2026-55487)

CWE-ID: CWE-346 - Origin Validation Error

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to origin validation error in the allowBuilds build policy when processing opaque dependency locators. A remote attacker can supply a specially crafted dependency source string that collides with an approved locator to execute arbitrary code.

User interaction is required to approve the dependency source and run the lifecycle script.


10) Inclusion of Functionality from Untrusted Control Sphere (CVE-ID: CVE-2026-55697)

CWE-ID: CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to inclusion of functionality from an untrusted control sphere in pnpm configDependencies / pacquet delegation when processing a repository-controlled pnpm-workspace.yaml and running dependency-management commands. A remote attacker can declare pacquet or @pnpm/pacquet as a config dependency so that pnpm resolves and spawns a platform-specific native binary to execute arbitrary code.

User interaction is required to run a dependency-management command such as pnpm install in the repository.


11) Path traversal (CVE-ID: CVE-2026-55699)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to delete files or directories outside the global bin directory.

The vulnerability exists due to path traversal in pnpm global add/remove bin cleanup when processing manifest-derived bin names during global package operations. A remote attacker can install a specially crafted package with reserved bin names to delete files or directories outside the global bin directory.

User interaction is required because the malicious package must be installed globally before a later global remove, update, or add-replacement flow triggers the deletion sink.


12) Inclusion of Functionality from Untrusted Control Sphere (CVE-ID: CVE-2026-55698)

CWE-ID: CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to inclusion of functionality from an untrusted control sphere in the pnpm package-manager env lockfile auto-switching path when processing a repository-controlled env lockfile during automatic version switching. A remote attacker can commit a specially crafted pnpm-lock.yaml file to cause arbitrary code execution.

User interaction is required because the victim must run pnpm directly in the malicious repository, and exploitation occurs when automatic package-manager version switching is triggered.


13) Path traversal (CVE-ID: CVE-2026-59196)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to overwrite files within the hoisted node_modules layout.

The vulnerability exists due to path traversal in hoisted lockfile alias handling when processing a crafted lockfile during a hoisted install. A remote attacker can supply a specially crafted lockfile alias to overwrite files within the hoisted node_modules layout.

User interaction is required to process the crafted lockfile.


14) Path traversal (CVE-ID: CVE-2026-59194)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to delete arbitrary files.

The vulnerability exists due to path traversal in patch-remove when processing a crafted patch entry. A remote attacker can supply a crafted patch path that resolves outside the configured patches directory to delete arbitrary files.

User interaction is required to run the pnpm patch-remove command on the crafted entry.


15) Path traversal (CVE-ID: CVE-2026-59195)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to create symlinks outside the intended directory.

The vulnerability exists due to path traversal in configDependencies env lockfile handling when processing config dependency names from a crafted pnpm-lock.yaml during installation. A remote attacker can supply a malicious repository containing traversal-shaped config dependency names to create symlinks outside the intended directory.

User interaction is required to install a malicious or compromised repository, and the issue can be triggered even when running with --ignore-scripts.


Remediation

Install update from vendor's website.

References