pnpm

Records32All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high19CVSS 7.0–8.9

Exploited now

pnpm records in CISA KEV

No pnpm vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Pnpm 28 records HIGH

Records

28 records in Pnpm · all components

TI-2025-42715 CVE-2025-69264 · GHSA-379q-355j-w6rj

pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"

HIGH 76

pnpm is a package manager.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01013 Published 2026-01-07 Fixed in 10.26.0 CWE-693

TI-2023-19086 CVE-2023-37478 · GHSA-5r98-f33j-g8h7

pnpm incorrectly parses tar archives relative to specification

HIGH 76

pnpm is a package manager.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.012 Published 2023-08-01 Fixed in 7.33.4, 8.6.8 +1 CWE-284

TI-2026-40212 CVE-2026-55698 · GHSA-w466-c33r-3gjp

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

HIGH 73

pnpm is a package manager.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00297 Published 2026-06-25 Fixed in 10.34.2, 11.5.3 CWE-345

TI-2026-40211 CVE-2026-55697 · GHSA-gj8w-mvpf-x27x

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

HIGH 73

pnpm is a package manager.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00191 Published 2026-06-25 Fixed in 10.34.2, 11.5.3 CWE-494

TI-2026-40042 CVE-2026-55487 · GHSA-5wx6-mg75-v57r

pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

HIGH 73

pnpm is a package manager.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00181 Published 2026-06-25 Fixed in 10.34.2, 11.5.3 CWE-346

TI-2026-36842 CVE-2026-50016 · GHSA-hwx4-2j3j-g496

pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

HIGH 73

pnpm is a package manager.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00527 Published 2026-06-25 Fixed in 10.33.4, 11.4.0 +1 CWE-23

TI-2025-42714 CVE-2025-69263 · GHSA-7vhp-vf5g-r2fw

pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies

HIGH 73

pnpm is a package manager.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00475 Published 2026-01-07 Fixed in 10.26.0 CWE-494

TI-2026-42342 CVE-2026-59195

pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

HIGH 69

pnpm is a package manager.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00401 Published 2026-07-06 Fixed in 10.34.4, 11.8.0 CWE-22

TI-2025-42713 CVE-2025-69262 · GHSA-2phv-j68v-wwqx

pnpm vulnerable to Command Injection via environment variable substitution

HIGH 69

pnpm is a package manager.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.01041 Published 2026-01-07 Fixed in 10.27.0 CWE-78

TI-2026-36841 CVE-2026-50015 · GHSA-rxhj-4m44-96r4

pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

HIGH 65

pnpm is a package manager.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00428 Published 2026-06-25 Fixed in 10.33.4, 11.4.0 +1 CWE-22

TI-2026-36249 CVE-2026-48995 · GHSA-hg3w-7f8c-63hp

pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

MEDIUM 63

pnpm is a package manager.

CVSS 4.0MEDIUM 4.8 Network No auth User interaction EPSS 0.00171 Published 2026-06-25 Fixed in 10.33.4, 11.0.7 CWE-353

TI-2026-19384 CVE-2026-24056 · GHSA-m733-5w8f-5ggw

pnpm has symlink traversal in file:/git dependencies

MEDIUM 63

pnpm is a package manager.

CVSS 4.0MEDIUM 6.7 Local No auth User interaction EPSS 0.00523 Published 2026-01-26 Partial fix · 10.28.2 CWE-22

TI-2026-40213 CVE-2026-55699 · GHSA-4gxm-v5v7-fqc4

pnpm: reserved bin name deletes PNPM_HOME during global remove

MEDIUM 62

pnpm is a package manager.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0045 Published 2026-06-25 Partial fix · 10.34.2, 11.5.3 CWE-22

TI-2026-39864 CVE-2026-55180 · GHSA-3qhv-2rgh-x77r

pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

MEDIUM 62

pnpm is a package manager.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00366 Published 2026-06-25 Partial fix · 10.34.2, 11.5.3 CWE-200

TI-2026-19248 CVE-2026-23890 · GHSA-xpqm-wm3m-f34h

pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin

MEDIUM 62

pnpm is a package manager.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00498 Published 2026-01-26 Partial fix · 10.28.1 CWE-23

TI-2026-19247 CVE-2026-23889 · GHSA-6x96-7vc8-cm3p

pnpm has Windows-specific tarball Path Traversal

MEDIUM 62

pnpm is a package manager.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00483 Published 2026-01-26 Partial fix · 10.28.1 CWE-22

TI-2026-19246 CVE-2026-23888 · GHSA-6pfh-p556-v868

pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)

MEDIUM 62

pnpm is a package manager.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0045 Published 2026-01-26 Partial fix · 10.28.1 CWE-22

TI-2024-36059 CVE-2024-53866 · GHSA-vm32-9rqf-rh3r

pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion

MEDIUM 61

The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other work…

CVSS 4.0MEDIUM 5.8 Network No auth User interaction EPSS 0.00977 Published 2024-12-10 Fixed in 9.15.0 CWE-426

TI-2022-09620 CVE-2022-26183 · GHSA-9m87-6fj3-c5xh

PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes…

MEDIUM 41

PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01594 Published 2022-03-21 Fixed in 6.15.1 CWE-426

TI-2026-36843 CVE-2026-50017 · GHSA-cjhr-43r9-cfmw

pnpm binds unscoped user-level npm auth credentials to a repository-selected registry

LOW 37

pnpm is a package manager.

CVSS 4.0MEDIUM 6.9 Network No auth User interaction EPSS 0.00437 Published 2026-06-25 Partial fix · 10.33.4, 11.4.0 +1 CWE-200

TI-2026-37294 CVE-2026-50573 · GHSA-54hh-g5mx-jqcp

pnpm: Unsafe default behavior breaks integrity check

LOW 36

pnpm is a package manager.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00168 Published 2026-06-25 Partial fix · 10.33.4, 11.4.0 +1 CWE-345

TI-2026-36847 CVE-2026-50021 · GHSA-q6j5-fjx5-2mc3

pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field

LOW 36

pnpm is a package manager.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00181 Published 2026-06-25 Fixed in 10.34.0, 11.4.0 +1 CWE-354

TI-2026-36840 CVE-2026-50014 · GHSA-p4xf-rf54-rj3x

pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

LOW 34

pnpm is a package manager.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00318 Published 2026-06-25 Partial fix · 10.33.4, 11.4.0 +1 CWE-88

TI-2026-42343 CVE-2026-59196

pnpm: hoisted install imports lockfile alias outside node_modules

LOW 31

pnpm is a package manager.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00401 Published 2026-07-06 Fixed in 10.34.4, 11.7.0 CWE-22

TI-2026-42341 CVE-2026-59194

pnpm: patch-remove could delete project-selected files outside the patches directory

LOW 31

pnpm is a package manager.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00401 Published 2026-07-06 Fixed in 10.34.4, 11.7.0 CWE-22

Open these records in search →

Critical	2
High	19
Medium	11
Low	0
No CVSS	0