CVE-2026-50014
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A vulnerability in pnpm package manager before versions 10.34.0 and 11.4.0 allows an attacker to inject Git options into the git fetch command via a malicious lockfile. Lack of validation of the commit value in the lockfile enables substitution of the --upload-pack option, which for SSH and local transports can lead to arbitrary command execution.
Risk Assessment
The organization risks remote code execution (RCE) when installing git dependencies if an attacker provides a malicious lockfile. The attack is particularly dangerous in environments using SSH or local git repositories.
Recommendation
Update pnpm to version 10.34.0 or 11.4.0 immediately. In the meantime, verify trust in lockfiles and limit the use of git dependencies from untrusted sources.
Other vulnerabilities in pnpm
See all- CVE-2024-53866Critical
The package manager pnpm prior to version 9.15.0 mishandles overrides and global cache. Overrides from one workspace leak into npm metadata saved in global cache, potentially leading to unauthorized code execution in other workspaces.
- CVE-2026-59196High
In the pnpm package manager prior to versions 10.34.4 and 11.7.0, a crafted lockfile alias could be placed directly under a hoisted node_modules directory. Traversal aliases could escape that directory, while reserved aliases such as .bin or .pnpm could overwrite pnpm-owned layout.
- CVE-2026-59195High
pnpm before versions 10.34.4 and 11.8.0 accepts package names from the configDependencies section of pnpm-lock.yaml and uses them directly when creating config dependency symlinks under node_modules/.pnpm-config. A malicious repository can supply a crafted lock file containing a traversal-shaped config dependency name, leading to symlink creation outside the intended directory.
- CVE-2026-59194High
In pnpm prior to versions 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory, allowing arbitrary file deletion via the pnpm patch-remove command.
- CVE-2026-55700High
The pnpm package manager from version 11.3.0 to 11.5.3 has a vulnerability where the `pnpm stage download` command derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file.
- CVE-2026-55699Medium
In pnpm prior to versions 10.34.2 and 11.5.3, a vulnerability was discovered where manifest bin object keys such as "", ".", and ".." passed pnpm's bin-name guard. When a malicious package was installed globally, later global remove, update, or add-replacement flows could re-derive those names from the installed manifest and pass path.join(globalBinDir, binName) to removeBin. For "." this targets the global bin directory; for ".." this targets its parent.
- CVE-2026-55698High
pnpm package manager prior to versions 10.34.2 and 11.5.3 persists bootstrap metadata in the first YAML document of pnpm-lock.yaml. A malicious repository can bypass fresh package-manager resolution and cause pnpm to install and execute arbitrary code during automatic version switching.
- CVE-2026-55697High
pnpm prior to versions 10.34.2 and 11.5.3 allows installation of configDependencies declared in pnpm-workspace.yaml before command dispatch. A repository can declare pacquet or @pnpm/pacquet as a config dependency, and pnpm treats this repository-controlled dependency as an install-engine opt-in. During installation, pnpm resolves a platform-specific @pacquet/<platform>-<arch>/pacquet binary from node_modules/.pnpm-config/<packageName> and spawns it as the developer or CI user.
- CVE-2026-55487High
In pnpm prior to versions 10.34.2 and 11.5.3, the generic peer-suffix normalizer incorrectly stripped parenthesized text from git, URL, tarball, file, and other opaque locators. Approval for one source string could authorize a different attacker-controlled source whose locator normalized to the same value.
- CVE-2026-55180Medium
A vulnerability in pnpm package manager prior to versions 10.34.2 and 11.5.3 expands ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace.yaml files into registry request destinations and credentials. A malicious repository can send victim environment secrets to an attacker-selected registry before lifecycle scripts run.
Original NVD description (English source)
pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm passes the lockfile-controlled git resolution.commit value to git fetch without a -- separator or commit-format validation. For git dependencies fetched through the shallow-fetch path, a malicious lockfile can replace the expected 40-character commit hash with a Git option such as --upload-pack=<command>. For SSH and local transports, --upload-pack can execute the supplied command. HTTPS transports ignore --upload-pack, so the practical attack surface is primarily SSH or local git dependencies. This vulnerability is fixed in 10.34.0 and 11.4.0.