pnpm
- Software type
- Package manager
- Total vulnerabilities (90 days)
- 4
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/13/2026, pnpm recorded 4 security vulnerabilities in the last 90 days, of which 4 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of pnpm and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-101044pacquet before 12.0.0-alpha.5 Path Traversal via lockfile aliasCVE-2026-101043pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy SettingsCVE-2026-82393pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on installCVE-2026-82392pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraphCVE-2026-59196pnpm: hoisted install imports lockfile alias outside node_modules| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-101044pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-101043pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings | Exploitation statusActively exploited | FixYes | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-82393pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install | Exploitation statusNot exploited | FixYes | Published08/31/2026 | SeverityHigh |
|---|
CVE-2026-82392pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph | Exploitation statusNot exploited | FixYes | Published08/31/2026 | SeverityHigh |
|---|
CVE-2026-59196pnpm: hoisted install imports lockfile alias outside node_modules | Exploitation statusNot exploited | FixYes | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-59195Path traversal in pnpm config dependency lockfile handling can create symlinks outside the intended directory | Exploitation statusActively exploited | FixYes | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-59194pnpm: patch-remove could delete project-selected files outside the patches directory | Exploitation statusNot exploited | FixYes | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-55700pnpm: stage download writes outside destination via manifest version traversal | Exploitation statusNot exploited | FixYes | Published06/25/2026 | SeverityHigh |
|---|
CVE-2026-55699pnpm: reserved bin name deletes PNPM_HOME during global remove | Exploitation statusActively exploited | FixYes | Published06/25/2026 | SeverityMedium |
|---|
CVE-2026-55698pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes | Exploitation statusActively exploited | FixYes | Published06/25/2026 | SeverityHigh |
|---|
CVE-2026-55697pnpm: Repository-controlled configDependencies can select a pacquet native install engine | Exploitation statusActively exploited | FixYes | Published06/25/2026 | SeverityHigh |
|---|
CVE-2026-55487pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle | Exploitation statusActively exploited | FixYes | Published06/25/2026 | SeverityHigh |
|---|
CVE-2026-55180pnpm: Repository config can expand victim environment secrets into registry requests before scripts run | Exploitation statusActively exploited | FixYes | Published06/25/2026 | SeverityMedium |
|---|
CVE-2026-50573pnpm: Unsafe default behavior breaks integrity check | Exploitation statusNot exploited | FixYes | Published06/25/2026 | SeverityMedium |
|---|
CVE-2026-50021pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field | Exploitation statusNot exploited | FixYes | Published06/25/2026 | SeverityMedium |
|---|
CVE-2026-50017pnpm binds unscoped user-level npm auth credentials to a repository-selected registry | Exploitation statusNot exploited | FixYes | Published06/25/2026 | SeverityMedium |
|---|
CVE-2026-50016pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement | Exploitation statusActively exploited | FixYes | Published06/25/2026 | SeverityHigh |
|---|
CVE-2026-50015pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal) | Exploitation statusActively exploited | FixYes | Published06/25/2026 | SeverityHigh |
|---|
CVE-2026-50014pnpm: Git Fetch Argument Injection via Lockfile resolution.commit | Exploitation statusNot exploited | FixYes | Published06/25/2026 | SeverityMedium |
|---|
CVE-2026-48995pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile | Exploitation statusActively exploited | FixYes | Published06/25/2026 | SeverityMedium |
|---|
CVE-2026-24131pnpm has Path Traversal via arbitrary file permission modification | Exploitation statusNot exploited | FixNo | Published01/26/2026 | SeverityMedium |
|---|
CVE-2026-24056pnpm has symlink traversal in file:/git dependencies | Exploitation statusActively exploited | FixNo | Published01/26/2026 | SeverityMedium |
|---|
CVE-2026-23890pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin | Exploitation statusActively exploited | FixNo | Published01/26/2026 | SeverityMedium |
|---|
CVE-2026-23889pnpm has Windows-specific tarball Path Traversal | Exploitation statusActively exploited | FixNo | Published01/26/2026 | SeverityMedium |
|---|
CVE-2026-23888pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip) | Exploitation statusActively exploited | FixNo | Published01/26/2026 | SeverityMedium |
|---|
CVE-2025-69264pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default" | Exploitation statusActively exploited | FixYes | Published01/07/2026 | SeverityHigh |
|---|
CVE-2025-69263pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies | Exploitation statusActively exploited | FixYes | Published01/07/2026 | SeverityHigh |
|---|
CVE-2025-69262pnpm vulnerable to Command Injection via environment variable substitution | Exploitation statusActively exploited | FixYes | Published01/07/2026 | SeverityHigh |
|---|
CVE-2024-47829pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting | Exploitation statusNot exploited | FixYes | Published04/23/2025 | SeverityMedium |
|---|
CVE-2024-53866pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion | Exploitation statusActively exploited | FixNo | Published12/10/2024 | SeverityMedium |
|---|
CVE-2023-37478pnpm incorrectly parses tar archives relative to specification | Exploitation statusActively exploited | FixYes | Published08/01/2023 | SeverityHigh |
|---|
31 Results | Page 1 of 1