TI-2025-42715 CVE-2025-69264 · GHSA-379q-355j-w6rj
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
Priority HIGH 76
pnpm is a package manager.
pnpm
Records32All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high19CVSS 7.0–8.9
Exploited now
pnpm records in CISA KEVNo pnpm vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
32 records
TI-2023-19086 CVE-2023-37478 · GHSA-5r98-f33j-g8h7
pnpm incorrectly parses tar archives relative to specification
Priority HIGH 76
pnpm is a package manager.
TI-2026-40212 CVE-2026-55698 · GHSA-w466-c33r-3gjp
pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes
Priority HIGH 73
pnpm is a package manager.
TI-2026-40211 CVE-2026-55697 · GHSA-gj8w-mvpf-x27x
pnpm: Repository-controlled configDependencies can select a pacquet native install engine
Priority HIGH 73
pnpm is a package manager.
TI-2026-40042 CVE-2026-55487 · GHSA-5wx6-mg75-v57r
pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle
Priority HIGH 73
pnpm is a package manager.
TI-2026-36842 CVE-2026-50016 · GHSA-hwx4-2j3j-g496
pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
Priority HIGH 73
pnpm is a package manager.
TI-2025-42714 CVE-2025-69263 · GHSA-7vhp-vf5g-r2fw
pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies
Priority HIGH 73
pnpm is a package manager.
TI-2026-65076 CVE-2026-101043 · GHSA-49pq-2gf3-jw76
pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings
Priority HIGH 69
pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml.
TI-2026-42342 CVE-2026-59195
pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
Priority HIGH 69
pnpm is a package manager.
TI-2025-42713 CVE-2025-69262 · GHSA-2phv-j68v-wwqx
pnpm vulnerable to Command Injection via environment variable substitution
Priority HIGH 69
pnpm is a package manager.
TI-2026-36841 CVE-2026-50015 · GHSA-rxhj-4m44-96r4
pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)
Priority HIGH 65
pnpm is a package manager.
TI-2026-36249 CVE-2026-48995 · GHSA-hg3w-7f8c-63hp
pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile
Priority MEDIUM 63
pnpm is a package manager.
TI-2026-19384 CVE-2026-24056 · GHSA-m733-5w8f-5ggw
pnpm has symlink traversal in file:/git dependencies
Priority MEDIUM 63
pnpm is a package manager.
TI-2026-40213 CVE-2026-55699 · GHSA-4gxm-v5v7-fqc4
pnpm: reserved bin name deletes PNPM_HOME during global remove
Priority MEDIUM 62
pnpm is a package manager.
TI-2026-39864 CVE-2026-55180 · GHSA-3qhv-2rgh-x77r
pnpm: Repository config can expand victim environment secrets into registry requests before scripts run
Priority MEDIUM 62
pnpm is a package manager.
TI-2026-19248 CVE-2026-23890 · GHSA-xpqm-wm3m-f34h
pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin
Priority MEDIUM 62
pnpm is a package manager.
TI-2026-19247 CVE-2026-23889 · GHSA-6x96-7vc8-cm3p
pnpm has Windows-specific tarball Path Traversal
Priority MEDIUM 62
pnpm is a package manager.
TI-2026-19246 CVE-2026-23888 · GHSA-6pfh-p556-v868
pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)
Priority MEDIUM 62
pnpm is a package manager.
TI-2024-36059 CVE-2024-53866 · GHSA-vm32-9rqf-rh3r
pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion
Priority MEDIUM 61
The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other work…
TI-2022-09620 CVE-2022-26183 · GHSA-9m87-6fj3-c5xh
PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes…
Priority MEDIUM 41
PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content.
TI-2026-36843 CVE-2026-50017 · GHSA-cjhr-43r9-cfmw
pnpm binds unscoped user-level npm auth credentials to a repository-selected registry
Priority LOW 37
pnpm is a package manager.
TI-2026-56810 CVE-2026-82393 · GHSA-vq4v-j7r6-jq4m
pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
Priority LOW 36
pnpm is a package manager.
TI-2026-37294 CVE-2026-50573 · GHSA-54hh-g5mx-jqcp
pnpm: Unsafe default behavior breaks integrity check
Priority LOW 36
pnpm is a package manager.
TI-2026-36847 CVE-2026-50021 · GHSA-q6j5-fjx5-2mc3
pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field
Priority LOW 36
pnpm is a package manager.
TI-2026-36840 CVE-2026-50014 · GHSA-p4xf-rf54-rj3x
pnpm: Git Fetch Argument Injection via Lockfile resolution.commit
Priority LOW 34
pnpm is a package manager.