Missing support for integrity check in pnpm - CVE-2026-48995
Published: May 25, 2026
Vulnerability identifier: #VU132258
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-48995
CWE-ID: CWE-353
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper integrity verification in the lockfile handling for GitHub git dependencies when downloading tarballs from codeload.github.com. A remote attacker can serve a malicious tarball to execute arbitrary code.
Only dependencies fetched from GitHub via codeload.github.com are affected because the lockfile does not store their tarball hash.
Affected software
pnpm
How to mitigate CVE-2026-48995
Install security update from vendor's website.
pnpm - addressed in versions 11.0.0, 11.0.7