pnpm
- Total products in the ecosystem
- 1
- Total vulnerabilities (90 days)
- 4
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
CyStack could not complete this security profile. The original vulnerability records remain available below.
As of 11/13/2026, pnpm recorded 4 security vulnerabilities in the last 90 days across 1 products, including 4 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, pnpm had the most security vulnerabilities in the pnpm ecosystem, with 4 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-101044pacquet before 12.0.0-alpha.5 Path Traversal via lockfile aliasCVE-2026-101043pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy SettingsCVE-2026-82393pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on installCVE-2026-82392pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraphCVE-2026-59196pnpm: hoisted install imports lockfile alias outside node_modules| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-101044pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias | Exploitation statusNot exploited | FixYes |
| Published09/27/2026 |
| SeverityHigh |
CVE-2026-101043pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings | Exploitation statusActively exploited | FixYes | Affected productpnpm | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-82393pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install | Exploitation statusNot exploited | FixYes | Affected productpnpm | Published08/31/2026 | SeverityHigh |
|---|
CVE-2026-82392pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph | Exploitation statusNot exploited | FixYes | Affected productpnpm | Published08/31/2026 | SeverityHigh |
|---|
CVE-2026-59196pnpm: hoisted install imports lockfile alias outside node_modules | Exploitation statusNot exploited | FixYes | Affected productpnpm | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-59195Path traversal in pnpm config dependency lockfile handling can create symlinks outside the intended directory | Exploitation statusActively exploited | FixYes | Affected productpnpm | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-59194pnpm: patch-remove could delete project-selected files outside the patches directory | Exploitation statusNot exploited | FixYes | Affected productpnpm | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-55700pnpm: stage download writes outside destination via manifest version traversal | Exploitation statusNot exploited | FixYes | Affected productpnpm | Published06/25/2026 | SeverityHigh |
|---|
CVE-2026-55699pnpm: reserved bin name deletes PNPM_HOME during global remove | Exploitation statusActively exploited | FixYes | Affected productpnpm | Published06/25/2026 | SeverityMedium |
|---|
CVE-2026-55698pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes | Exploitation statusActively exploited | FixYes | Affected productpnpm | Published06/25/2026 | SeverityHigh |
|---|
CVE-2026-55697pnpm: Repository-controlled configDependencies can select a pacquet native install engine | Exploitation statusActively exploited | FixYes | Affected productpnpm | Published06/25/2026 | SeverityHigh |
|---|
CVE-2026-55487pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle | Exploitation statusActively exploited | FixYes | Affected productpnpm | Published06/25/2026 | SeverityHigh |
|---|
CVE-2026-55180pnpm: Repository config can expand victim environment secrets into registry requests before scripts run | Exploitation statusActively exploited | FixYes | Affected productpnpm | Published06/25/2026 | SeverityMedium |
|---|
CVE-2026-50573pnpm: Unsafe default behavior breaks integrity check | Exploitation statusNot exploited | FixYes | Affected productpnpm | Published06/25/2026 | SeverityMedium |
|---|
CVE-2026-50021pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field | Exploitation statusNot exploited | FixYes | Affected productpnpm | Published06/25/2026 | SeverityMedium |
|---|
CVE-2026-50017pnpm binds unscoped user-level npm auth credentials to a repository-selected registry | Exploitation statusNot exploited | FixYes | Affected productpnpm | Published06/25/2026 | SeverityMedium |
|---|
CVE-2026-50016pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement | Exploitation statusActively exploited | FixYes | Affected productpnpm | Published06/25/2026 | SeverityHigh |
|---|
CVE-2026-50015pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal) | Exploitation statusActively exploited | FixYes | Affected productpnpm | Published06/25/2026 | SeverityHigh |
|---|
CVE-2026-50014pnpm: Git Fetch Argument Injection via Lockfile resolution.commit | Exploitation statusNot exploited | FixYes | Affected productpnpm | Published06/25/2026 | SeverityMedium |
|---|
CVE-2026-48995pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile | Exploitation statusActively exploited | FixYes | Affected productpnpm | Published06/25/2026 | SeverityMedium |
|---|
CVE-2026-24131pnpm has Path Traversal via arbitrary file permission modification | Exploitation statusNot exploited | FixNo | Affected productpnpm | Published01/26/2026 | SeverityMedium |
|---|
CVE-2026-24056pnpm has symlink traversal in file:/git dependencies | Exploitation statusActively exploited | FixNo | Affected productpnpm | Published01/26/2026 | SeverityMedium |
|---|
CVE-2026-23890pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin | Exploitation statusActively exploited | FixNo | Affected productpnpm | Published01/26/2026 | SeverityMedium |
|---|
CVE-2026-23889pnpm has Windows-specific tarball Path Traversal | Exploitation statusActively exploited | FixNo | Affected productpnpm | Published01/26/2026 | SeverityMedium |
|---|
CVE-2026-23888pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip) | Exploitation statusActively exploited | FixNo | Affected productpnpm | Published01/26/2026 | SeverityMedium |
|---|
CVE-2025-69264pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default" | Exploitation statusActively exploited | FixYes | Affected productpnpm | Published01/07/2026 | SeverityHigh |
|---|
CVE-2025-69263pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies | Exploitation statusActively exploited | FixYes | Affected productpnpm | Published01/07/2026 | SeverityHigh |
|---|
CVE-2025-69262pnpm vulnerable to Command Injection via environment variable substitution | Exploitation statusActively exploited | FixYes | Affected productpnpm | Published01/07/2026 | SeverityHigh |
|---|
CVE-2024-47829pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting | Exploitation statusNot exploited | FixYes | Affected productpnpm | Published04/23/2025 | SeverityMedium |
|---|
CVE-2024-53866pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion | Exploitation statusActively exploited | FixNo | Affected productpnpm | Published12/10/2024 | SeverityMedium |
|---|
CVE-2023-37478pnpm incorrectly parses tar archives relative to specification | Exploitation statusActively exploited | FixYes | Affected productpnpm | Published08/01/2023 | SeverityHigh |
|---|
31 Results | Page 1 of 1