Pnpm Pnpm
32 CVEs affecting Pnpm Pnpm. Latest disclosed: 2026-09-27. Critical: 1, High: 19.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-53866 | Critical | 9.8 | 2024-12-10 | The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in gl… |
CVE-2026-55698 | High | 8.8 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pnpm-lock.yaml. Befor… |
CVE-2026-50016 | High | 8.8 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segm… |
CVE-2025-69264 | High | 8.8 | 2026-01-07 | pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 sec… |
CVE-2022-26183 | High | 8.8 | 2022-03-21 | PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM com… |
CVE-2026-59195 | High | 8.2 | 2026-07-06 | pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those names direct… |
CVE-2026-82393 | High | 7.5 | 2026-08-31 | pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm… |
CVE-2026-55697 | High | 7.5 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command dispatch. Before the… |
CVE-2026-55487 | High | 7.5 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stripped parenthesized text from git, URL, tarball, file, and o… |
CVE-2026-48995 | High | 7.5 | 2026-06-25 | pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it reg… |
CVE-2025-69262 | High | 7.5 | 2026-01-07 | pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc config… |
CVE-2025-69263 | High | 7.5 | 2026-01-07 | pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This… |
CVE-2023-37478 | High | 7.5 | 2023-08-01 | pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is… |
CVE-2026-101043 | High | 7.4 | 2026-09-27 | pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy setting… |
CVE-2026-50015 | High | 7.3 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's patch application pipeline (@pnpm/patch-package) performs no path validation on file paths extra… |
CVE-2026-101044 | High | 7.1 | 2026-09-27 | pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate dependency alias/n… |
CVE-2026-82392 | High | 7.1 | 2026-08-31 | pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys w… |
CVE-2026-59196 | High | 7.1 | 2026-07-06 | pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined directly under a hoisted node_modules directory. Traversal ali… |
CVE-2026-59194 | High | 7.1 | 2026-07-06 | pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory and cause pnpm patch-remov… |
CVE-2026-55700 | High | 7.1 | 2026-06-25 | pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A… |