Read the docs
TI-2022-09620 Aliases CVE-2022-26183GHSA-9m87-6fj3-c5xh

PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes…

Priority MEDIUM 41CWE-426Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-426.

Summary

PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.

Why it matters now

EPSS 0.01594 75th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed pnpm (npm): 6.15.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—pnpm (npm)before 6.15.16.15.1Patch availableGHSA-9m87-6fj3-c5xh
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • pnpm (npm) Vendor— Affected before 6.15.1 Fixed in 6.15.1 Patch available GHSA-9m87-6fj3-c5xh

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:node.js:*:*before 6.15.1Vulnerablepnpm
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:node.js:*:* Versions before 6.15.1 Vulnerable ·pnpm
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · GHSA-9m87-6fj3-c5xh pnpm (npm) Fixed in 6.15.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-26183
  2. 2026-10-03 Alias added: GHSA-9m87-6fj3-c5xh

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2025-42715 pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default" CVSS 3.1CRITICAL 9.8
  • TI-2023-19086 pnpm incorrectly parses tar archives relative to specification CVSS 3.1CRITICAL 9.8
  • TI-2026-40212 pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes CVSS 3.1HIGH 8.8
  • TI-2026-40211 pnpm: Repository-controlled configDependencies can select a pacquet native install engine CVSS 3.1HIGH 8.8
  • TI-2026-40042 pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle CVSS 3.1HIGH 8.8
  • TI-2026-36842 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement CVSS 3.1HIGH 8.8
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences