Vulnerability intelligence npm

pnpm

Fast, disk space efficient package manager

npm latest 12.11.2 MIT

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

Latest version

12.11.2

No matching published advisory returned

Known exploitation

No KEV match

Checked by exact CVE identifier

Highest advisory severity

High

32 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

GHSA-vx52-2968-3vc6 high

pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

Sep 28, 2026

Affected range

SEMVER: introduced 11.0.0; fixed 11.11.0SEMVER: introduced 10.7.0; fixed 10.34.5

Fixed versions: 11.11.0, 10.34.5

CVE-2026-101043 Source ↗Source ↗

GHSA-5r98-f33j-g8h7 high

pnpm incorrectly parses tar archives relative to specification

Sep 10, 2026

Affected range

SEMVER: introduced 0; fixed 7.33.4SEMVER: introduced 8.0.0; fixed 8.6.8

Fixed versions: 7.33.4, 8.6.8

CVE-2023-37478 Source ↗Source ↗

GHSA-c59q-g84q-2gj5 high

pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

Sep 2, 2026

Affected range

SEMVER: introduced 0; fixed 10.34.5SEMVER: introduced 11.0.0; fixed 11.11.0

Fixed versions: 10.34.5, 11.11.0

CVE-2026-82392 Source ↗Source ↗

GHSA-vq4v-j7r6-jq4m high

pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

Sep 2, 2026

Affected range

SEMVER: introduced 0; fixed 10.34.5SEMVER: introduced 11.0.0; fixed 11.11.0

Fixed versions: 10.34.5, 11.11.0

CVE-2026-82393 Source ↗Source ↗

GHSA-2rx9-3g3h-c2jv high

pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

Sep 1, 2026

Affected range

SEMVER: introduced 12.0.0-alpha.0; fixed 12.0.0-alpha.5

Fixed versions: 12.0.0-alpha.5

Source ↗Source ↗

GHSA-gj8w-mvpf-x27x high

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

Aug 28, 2026

Affected range

SEMVER: introduced 0; fixed 10.34.2SEMVER: introduced 11.0.0; fixed 11.5.3

Fixed versions: 10.34.2, 11.5.3

CVE-2026-55697 Source ↗Source ↗

GHSA-fr4h-3cph-29xv high

pnpm: Hoisted install imports lockfile alias outside node_modules

Jul 8, 2026

Affected range

SEMVER: introduced 0; fixed 10.34.4SEMVER: introduced 11.0.0; fixed 11.7.0

Fixed versions: 10.34.4, 11.7.0

CVE-2026-59196 Source ↗Source ↗

GHSA-72r4-9c5j-mj57 high

pnpm: `patch-remove` could delete project-selected files outside the patches directory

Jul 8, 2026

Affected range

SEMVER: introduced 0; fixed 10.34.4SEMVER: introduced 11.0.0; fixed 11.7.0

Fixed versions: 10.34.4, 11.7.0

CVE-2026-59194 Source ↗Source ↗

GHSA-qrv3-253h-g69c high

pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

Jul 8, 2026

Affected range

SEMVER: introduced 0; fixed 10.34.4SEMVER: introduced 11.0.0; fixed 11.8.0

Fixed versions: 10.34.4, 11.8.0

CVE-2026-59195 Source ↗Source ↗

GHSA-v23m-ccfg-pq9h high

pnpm: `stage download` writes outside its destination directory via manifest name/version traversal

Jun 27, 2026

Affected range

SEMVER: introduced 11.3.0; fixed 11.5.3

Fixed versions: 11.5.3

CVE-2026-55700 Source ↗Source ↗

GHSA-w466-c33r-3gjp high

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

Jun 26, 2026

Affected range

SEMVER: introduced 0; fixed 10.34.2SEMVER: introduced 11.0.0; fixed 11.5.3

Fixed versions: 10.34.2, 11.5.3

CVE-2026-55698 Source ↗Source ↗

GHSA-5wx6-mg75-v57r high

pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

Jun 26, 2026

Affected range

SEMVER: introduced 0; fixed 10.34.2SEMVER: introduced 11.0.0; fixed 11.5.3

Fixed versions: 10.34.2, 11.5.3

CVE-2026-55487 Source ↗Source ↗

GHSA-rxhj-4m44-96r4 high

pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

Jun 26, 2026

Affected range

SEMVER: introduced 0; fixed 10.34.0SEMVER: introduced 11.0.0; fixed 11.4.0

Fixed versions: 10.34.0, 11.4.0

CVE-2026-50015 Source ↗Source ↗

GHSA-hwx4-2j3j-g496 high

pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

Jun 26, 2026

Affected range

SEMVER: introduced 0; fixed 10.34.0SEMVER: introduced 11.0.0; fixed 11.4.0

Fixed versions: 10.34.0, 11.4.0

CVE-2026-50016 Source ↗Source ↗

GHSA-7vhp-vf5g-r2fw high

pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies

Feb 3, 2026

Affected range

SEMVER: introduced 0; fixed 10.26.0

Fixed versions: 10.26.0

CVE-2025-69263 Source ↗Source ↗

GHSA-379q-355j-w6rj high

pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"

Feb 3, 2026

Affected range

SEMVER: introduced 10.0.0; fixed 10.26.0

Fixed versions: 10.26.0

CVE-2025-69264 Source ↗Source ↗

GHSA-2phv-j68v-wwqx high

pnpm vulnerable to Command Injection via environment variable substitution

Feb 3, 2026

Affected range

SEMVER: introduced 6.25.0; fixed 10.27.0

Fixed versions: 10.27.0

CVE-2025-69262 Source ↗Source ↗

GHSA-9m87-6fj3-c5xh high

Untrusted Search Path in PNPM

Nov 8, 2023

Affected range

SEMVER: introduced 0; fixed 6.15.1

Fixed versions: 6.15.1

CVE-2022-26183 Source ↗Source ↗

GHSA-vm32-9rqf-rh3r moderate

pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion

Sep 10, 2026

Affected range

SEMVER: introduced 0; fixed 9.15.0

Fixed versions: 9.15.0

CVE-2024-53866 Source ↗Source ↗

GHSA-4gxm-v5v7-fqc4 moderate

pnpm: Reserved bin name deletes PNPM_HOME during global remove

Jun 27, 2026

Affected range

SEMVER: introduced 0; fixed 10.34.2SEMVER: introduced 11.0.0; fixed 11.5.3

Fixed versions: 10.34.2, 11.5.3

CVE-2026-55699 Source ↗Source ↗

GHSA-3qhv-2rgh-x77r moderate

pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

Jun 26, 2026

Affected range

SEMVER: introduced 0; fixed 10.34.2SEMVER: introduced 11.0.0; fixed 11.5.3

Fixed versions: 10.34.2, 11.5.3

CVE-2026-55180 Source ↗Source ↗

GHSA-cjhr-43r9-cfmw moderate

pnpm binds unscoped user-level npm auth credentials to a repository-selected registry

Jun 26, 2026

Affected range

SEMVER: introduced 0; fixed 10.34.0SEMVER: introduced 11.0.0; fixed 11.4.0

Fixed versions: 10.34.0, 11.4.0

CVE-2026-50017 Source ↗Source ↗

GHSA-54hh-g5mx-jqcp moderate

pnpm: Unsafe default behavior breaks integrity check

Jun 26, 2026

Affected range

SEMVER: introduced 0; fixed 10.34.0SEMVER: introduced 11.0.0; fixed 11.4.0

Fixed versions: 10.34.0, 11.4.0

CVE-2026-50573 Source ↗Source ↗

GHSA-p4xf-rf54-rj3x moderate

pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

Jun 26, 2026

Affected range

SEMVER: introduced 0; fixed 10.34.0SEMVER: introduced 11.0.0; fixed 11.4.0

Fixed versions: 10.34.0, 11.4.0

CVE-2026-50014 Source ↗Source ↗

GHSA-q6j5-fjx5-2mc3 moderate

pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field

Jun 26, 2026

Affected range

SEMVER: introduced 11.0.0; fixed 11.4.0SEMVER: introduced 0; fixed 10.34.1

Fixed versions: 11.4.0, 10.34.1

CVE-2026-50021 Source ↗Source ↗

Show 7 more advisories

GHSA-hg3w-7f8c-63hp pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

GHSA-v253-rj99-jwpq pnpm has Path Traversal via arbitrary file permission modification

GHSA-6pfh-p556-v868 pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)

GHSA-m733-5w8f-5ggw pnpm has symlink traversal in file:/git dependencies

GHSA-xpqm-wm3m-f34h pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin

GHSA-6x96-7vc8-cm3p pnpm has Windows-specific tarball Path Traversal

GHSA-8cc4-rfj6-fhg4 pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting