Vulnerabilities

TI-2026-65077 CVE-2026-101044 · GHSA-qj85-gv7w-fqmr

pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias

LOW 31

pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-…

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00259 Published 2026-09-27 Partial fix · 12.0.0-alpha.5 CWE-22

TI-2026-65076 CVE-2026-101043 · GHSA-49pq-2gf3-jw76

pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings

HIGH 69

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml.

CVSS 4.0HIGH 8.3 Network No auth User interaction EPSS 0.00285 Published 2026-09-27 Partial fix · 11.11.0, 10.34.5 CWE-201

TI-2026-56810 CVE-2026-82393 · GHSA-vq4v-j7r6-jq4m

pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

LOW 36

pnpm is a package manager.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00626 Published 2026-08-31 Fixed in 10.34.5, 11.11.0 CWE-22

TI-2026-56809 CVE-2026-82392 · GHSA-c59q-g84q-2gj5

pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

LOW 32

pnpm is a package manager.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00615 Published 2026-08-31 Fixed in 10.34.5, 11.11.0 CWE-22

TI-2026-42342 CVE-2026-59195

pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

HIGH 69

pnpm is a package manager.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00401 Published 2026-07-06 Fixed in 10.34.4, 11.8.0 CWE-22

TI-2026-42343 CVE-2026-59196

pnpm: hoisted install imports lockfile alias outside node_modules

LOW 31

pnpm is a package manager.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00401 Published 2026-07-06 Fixed in 10.34.4, 11.7.0 CWE-22

TI-2026-42341 CVE-2026-59194

pnpm: patch-remove could delete project-selected files outside the patches directory

LOW 31

pnpm is a package manager.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00401 Published 2026-07-06 Fixed in 10.34.4, 11.7.0 CWE-22

TI-2026-39864 CVE-2026-55180 · GHSA-3qhv-2rgh-x77r

pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

MEDIUM 62

pnpm is a package manager.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00366 Published 2026-06-25 Partial fix · 10.34.2, 11.5.3 CWE-200

TI-2026-36249 CVE-2026-48995 · GHSA-hg3w-7f8c-63hp

pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

MEDIUM 63

pnpm is a package manager.

CVSS 4.0MEDIUM 4.8 Network No auth User interaction EPSS 0.00171 Published 2026-06-25 Fixed in 10.33.4, 11.0.7 CWE-353

TI-2026-36843 CVE-2026-50017 · GHSA-cjhr-43r9-cfmw

pnpm binds unscoped user-level npm auth credentials to a repository-selected registry

LOW 37

pnpm is a package manager.

CVSS 4.0MEDIUM 6.9 Network No auth User interaction EPSS 0.00437 Published 2026-06-25 Partial fix · 10.33.4, 11.4.0 +1 CWE-200

TI-2026-36842 CVE-2026-50016 · GHSA-hwx4-2j3j-g496

pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

HIGH 73

pnpm is a package manager.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00527 Published 2026-06-25 Fixed in 10.33.4, 11.4.0 +1 CWE-23

TI-2026-36841 CVE-2026-50015 · GHSA-rxhj-4m44-96r4

pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

HIGH 65

pnpm is a package manager.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00428 Published 2026-06-25 Fixed in 10.33.4, 11.4.0 +1 CWE-22

TI-2026-36840 CVE-2026-50014 · GHSA-p4xf-rf54-rj3x

pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

LOW 34

pnpm is a package manager.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00318 Published 2026-06-25 Partial fix · 10.33.4, 11.4.0 +1 CWE-88

TI-2026-37294 CVE-2026-50573 · GHSA-54hh-g5mx-jqcp

pnpm: Unsafe default behavior breaks integrity check

LOW 36

pnpm is a package manager.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00168 Published 2026-06-25 Partial fix · 10.33.4, 11.4.0 +1 CWE-345

TI-2026-36847 CVE-2026-50021 · GHSA-q6j5-fjx5-2mc3

pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field

LOW 36

pnpm is a package manager.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00181 Published 2026-06-25 Fixed in 10.34.0, 11.4.0 +1 CWE-354

TI-2026-40214 CVE-2026-55700 · GHSA-v23m-ccfg-pq9h

pnpm: stage download writes outside destination via manifest version traversal

LOW 31

pnpm is a package manager.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00417 Published 2026-06-25 Fixed in 11.5.3 CWE-22

TI-2026-40213 CVE-2026-55699 · GHSA-4gxm-v5v7-fqc4

pnpm: reserved bin name deletes PNPM_HOME during global remove

MEDIUM 62

pnpm is a package manager.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0045 Published 2026-06-25 Partial fix · 10.34.2, 11.5.3 CWE-22

TI-2026-40212 CVE-2026-55698 · GHSA-w466-c33r-3gjp

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

HIGH 73

pnpm is a package manager.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00297 Published 2026-06-25 Fixed in 10.34.2, 11.5.3 CWE-345

TI-2026-40211 CVE-2026-55697 · GHSA-gj8w-mvpf-x27x

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

HIGH 73

pnpm is a package manager.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00191 Published 2026-06-25 Fixed in 10.34.2, 11.5.3 CWE-494

TI-2026-40042 CVE-2026-55487 · GHSA-5wx6-mg75-v57r

pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

HIGH 73

pnpm is a package manager.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00181 Published 2026-06-25 Fixed in 10.34.2, 11.5.3 CWE-346

TI-2026-19449 CVE-2026-24131 · GHSA-v253-rj99-jwpq

pnpm has Path Traversal via arbitrary file permission modification

LOW 29

pnpm is a package manager.

CVSS 4.0MEDIUM 6.7 Local No auth User interaction EPSS 0.00271 Published 2026-01-26 Partial fix · 10.28.2 CWE-22

TI-2026-19384 CVE-2026-24056 · GHSA-m733-5w8f-5ggw

pnpm has symlink traversal in file:/git dependencies

MEDIUM 63

pnpm is a package manager.

CVSS 4.0MEDIUM 6.7 Local No auth User interaction EPSS 0.00523 Published 2026-01-26 Partial fix · 10.28.2 CWE-22

TI-2026-19248 CVE-2026-23890 · GHSA-xpqm-wm3m-f34h

pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin

MEDIUM 62

pnpm is a package manager.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00498 Published 2026-01-26 Partial fix · 10.28.1 CWE-23

TI-2026-19247 CVE-2026-23889 · GHSA-6x96-7vc8-cm3p

pnpm has Windows-specific tarball Path Traversal

MEDIUM 62

pnpm is a package manager.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00483 Published 2026-01-26 Partial fix · 10.28.1 CWE-22

TI-2026-19246 CVE-2026-23888 · GHSA-6pfh-p556-v868

pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)

MEDIUM 62

pnpm is a package manager.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0045 Published 2026-01-26 Partial fix · 10.28.1 CWE-22

Vulnerabilities

Filters