Vulnerabilities

TI-2026-42342 CVE-2026-59195

pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

HIGH 69

pnpm is a package manager.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00401 Published 2026-07-06 Fixed in 10.34.4, 11.8.0 CWE-22

TI-2026-42343 CVE-2026-59196

pnpm: hoisted install imports lockfile alias outside node_modules

LOW 31

pnpm is a package manager.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00401 Published 2026-07-06 Fixed in 10.34.4, 11.7.0 CWE-22

TI-2026-42341 CVE-2026-59194

pnpm: patch-remove could delete project-selected files outside the patches directory

LOW 31

pnpm is a package manager.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00401 Published 2026-07-06 Fixed in 10.34.4, 11.7.0 CWE-22

TI-2026-39864 CVE-2026-55180 · GHSA-3qhv-2rgh-x77r

pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

MEDIUM 62

pnpm is a package manager.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00366 Published 2026-06-25 Partial fix · 10.34.2, 11.5.3 CWE-200

TI-2026-36249 CVE-2026-48995 · GHSA-hg3w-7f8c-63hp

pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

MEDIUM 63

pnpm is a package manager.

CVSS 4.0MEDIUM 4.8 Network No auth User interaction EPSS 0.00171 Published 2026-06-25 Fixed in 10.33.4, 11.0.7 CWE-353

TI-2026-36843 CVE-2026-50017 · GHSA-cjhr-43r9-cfmw

pnpm binds unscoped user-level npm auth credentials to a repository-selected registry

LOW 37

pnpm is a package manager.

CVSS 4.0MEDIUM 6.9 Network No auth User interaction EPSS 0.00437 Published 2026-06-25 Partial fix · 10.33.4, 11.4.0 +1 CWE-200

TI-2026-36842 CVE-2026-50016 · GHSA-hwx4-2j3j-g496

pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

HIGH 73

pnpm is a package manager.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00527 Published 2026-06-25 Fixed in 10.33.4, 11.4.0 +1 CWE-23

TI-2026-36841 CVE-2026-50015 · GHSA-rxhj-4m44-96r4

pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

HIGH 65

pnpm is a package manager.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00428 Published 2026-06-25 Fixed in 10.33.4, 11.4.0 +1 CWE-22

TI-2026-36840 CVE-2026-50014 · GHSA-p4xf-rf54-rj3x

pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

LOW 34

pnpm is a package manager.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00318 Published 2026-06-25 Partial fix · 10.33.4, 11.4.0 +1 CWE-88

TI-2026-37294 CVE-2026-50573 · GHSA-54hh-g5mx-jqcp

pnpm: Unsafe default behavior breaks integrity check

LOW 36

pnpm is a package manager.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00168 Published 2026-06-25 Partial fix · 10.33.4, 11.4.0 +1 CWE-345

TI-2026-36847 CVE-2026-50021 · GHSA-q6j5-fjx5-2mc3

pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field

LOW 36

pnpm is a package manager.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00181 Published 2026-06-25 Fixed in 10.34.0, 11.4.0 +1 CWE-354

TI-2026-40214 CVE-2026-55700 · GHSA-v23m-ccfg-pq9h

pnpm: stage download writes outside destination via manifest version traversal

LOW 31

pnpm is a package manager.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00417 Published 2026-06-25 Fixed in 11.5.3 CWE-22

TI-2026-40213 CVE-2026-55699 · GHSA-4gxm-v5v7-fqc4

pnpm: reserved bin name deletes PNPM_HOME during global remove

MEDIUM 62

pnpm is a package manager.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0045 Published 2026-06-25 Partial fix · 10.34.2, 11.5.3 CWE-22

TI-2026-40212 CVE-2026-55698 · GHSA-w466-c33r-3gjp

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

HIGH 73

pnpm is a package manager.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00297 Published 2026-06-25 Fixed in 10.34.2, 11.5.3 CWE-345

TI-2026-40211 CVE-2026-55697 · GHSA-gj8w-mvpf-x27x

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

HIGH 73

pnpm is a package manager.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00191 Published 2026-06-25 Fixed in 10.34.2, 11.5.3 CWE-494

TI-2026-40042 CVE-2026-55487 · GHSA-5wx6-mg75-v57r

pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

HIGH 73

pnpm is a package manager.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00181 Published 2026-06-25 Fixed in 10.34.2, 11.5.3 CWE-346

TI-2026-19449 CVE-2026-24131 · GHSA-v253-rj99-jwpq

pnpm has Path Traversal via arbitrary file permission modification

LOW 29

pnpm is a package manager.

CVSS 4.0MEDIUM 6.7 Local No auth User interaction EPSS 0.00271 Published 2026-01-26 Partial fix · 10.28.2 CWE-22

TI-2026-19384 CVE-2026-24056 · GHSA-m733-5w8f-5ggw

pnpm has symlink traversal in file:/git dependencies

MEDIUM 63

pnpm is a package manager.

CVSS 4.0MEDIUM 6.7 Local No auth User interaction EPSS 0.00523 Published 2026-01-26 Partial fix · 10.28.2 CWE-22

TI-2026-19248 CVE-2026-23890 · GHSA-xpqm-wm3m-f34h

pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin

MEDIUM 62

pnpm is a package manager.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00498 Published 2026-01-26 Partial fix · 10.28.1 CWE-23

TI-2026-19247 CVE-2026-23889 · GHSA-6x96-7vc8-cm3p

pnpm has Windows-specific tarball Path Traversal

MEDIUM 62

pnpm is a package manager.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00483 Published 2026-01-26 Partial fix · 10.28.1 CWE-22

TI-2026-19246 CVE-2026-23888 · GHSA-6pfh-p556-v868

pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)

MEDIUM 62

pnpm is a package manager.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0045 Published 2026-01-26 Partial fix · 10.28.1 CWE-22

TI-2025-42713 CVE-2025-69262 · GHSA-2phv-j68v-wwqx

pnpm vulnerable to Command Injection via environment variable substitution

HIGH 69

pnpm is a package manager.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.01041 Published 2026-01-07 Fixed in 10.27.0 CWE-78

TI-2025-42715 CVE-2025-69264 · GHSA-379q-355j-w6rj

pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"

HIGH 76

pnpm is a package manager.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01013 Published 2026-01-07 Fixed in 10.26.0 CWE-693

TI-2025-42714 CVE-2025-69263 · GHSA-7vhp-vf5g-r2fw

pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies

HIGH 73

pnpm is a package manager.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00475 Published 2026-01-07 Fixed in 10.26.0 CWE-494

TI-2024-32096 CVE-2024-47829 · GHSA-8cc4-rfj6-fhg4

pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting

LOW 28

pnpm is a package manager.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00235 Published 2025-04-23 Partial fix · 10.0.0 CWE-328

Vulnerabilities

Filters