Insufficient verification of data authenticity in pnpm - #VU153374
Published: October 6, 2026
Vulnerability identifier: #VU153374
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-345
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause installation of config dependencies without registry verification.
The vulnerability exists due to missing dependency authenticity verification in locked config dependency installation when processing config dependencies from a lockfile. A local user can supply a lockfile containing config dependencies that a victim installs to cause installation of config dependencies without registry verification.
Config dependencies are not restricted to npm registry sources.
Affected software
pnpm
Remediation
Install security update from vendor's website.
pnpm - update to 12.10.0