Skip to main content
cve.nowby Sazabi
← npm
npmPackage

pnpm

31 known vulnerabilities (16 high, 14 medium), with the versions each affects and the releases that fix them.

Latest release
12.18.0 (Nov 5, 2026): no advisory affects it
Newest unaffected release
12.18.0 (Nov 5, 2026), the latest release
Advisories
31 · 16 high, 14 medium
Weekly downloads
308M
Dependents
10
Releases
500+ since 6.34.0 (Aug 3, 2022)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-101043
    Affects 10.7.0 to 10.34.4 (10.34.5 is outside it); 11.0.0 to 11.10.0 (11.11.0 is outside it)
  • CVE-2026-82393
    Affects 6.34.0 to 10.34.4 (10.34.5 is outside it); 11.0.0 to 11.10.0 (11.11.0 is outside it)
  • CVE-2026-82392
    Affects 6.34.0 to 10.34.4 (10.34.5 is outside it); 11.0.0 to 11.10.0 (11.11.0 is outside it)
  • CVE-2026-59195
    Affects 6.34.0 to 10.34.3 (10.34.4 is outside it); 11.0.0 to 11.7.0 (11.8.0 is outside it)
  • CVE-2026-59196
    Affects 6.34.0 to 10.34.3 (10.34.4 is outside it); 11.0.0 to 11.6.0 (11.7.0 is outside it)
  • CVE-2026-59194
    Affects 6.34.0 to 10.34.3 (10.34.4 is outside it); 11.0.0 to 11.6.0 (11.7.0 is outside it)
  • CVE-2026-55180
    Affects 6.34.0 to 10.34.1 (10.34.2 is outside it); 11.0.0 to 11.5.2 (11.5.3 is outside it)
  • CVE-2026-48995
    Affects 6.34.0 to 10.33.3 (10.33.4 is outside it); 11.0.0 to 11.0.6 (11.0.7 is outside it)
  • CVE-2026-50017
    Affects 6.34.0 to 10.33.4 (10.34.0 is outside it); 11.0.0 to 11.3.0 (11.4.0 is outside it)
  • CVE-2026-50016
    Affects 6.34.0 to 10.33.4 (10.34.0 is outside it); 11.0.0 to 11.3.0 (11.4.0 is outside it)
  • CVE-2026-50015
    Affects 6.34.0 to 10.33.4 (10.34.0 is outside it); 11.0.0 to 11.3.0 (11.4.0 is outside it)
  • CVE-2026-50014
    Affects 6.34.0 to 10.33.4 (10.34.0 is outside it); 11.0.0 to 11.3.0 (11.4.0 is outside it)
Show all 31 advisoriesShow fewer advisories
  • CVE-2026-50573
    Affects 6.34.0 to 10.33.4 (10.34.0 is outside it); 11.0.0 to 11.3.0 (11.4.0 is outside it)
  • CVE-2026-50021
    Affects 6.34.0 to 10.34.0 (10.34.1 is outside it); 11.0.0 to 11.3.0 (11.4.0 is outside it)
  • CVE-2026-55700
    Affects 11.3.0 to 11.5.2 (11.5.3 is outside it)
  • CVE-2026-55699
    Affects 6.34.0 to 10.34.1 (10.34.2 is outside it); 11.0.0 to 11.5.2 (11.5.3 is outside it)
  • CVE-2026-55698
    Affects 6.34.0 to 10.34.1 (10.34.2 is outside it); 11.0.0 to 11.5.2 (11.5.3 is outside it)
  • CVE-2026-55697
    Affects 6.34.0 to 10.34.1 (10.34.2 is outside it); 11.0.0 to 11.5.2 (11.5.3 is outside it)
  • CVE-2026-55487
    Affects 6.34.0 to 10.34.1 (10.34.2 is outside it); 11.0.0 to 11.5.2 (11.5.3 is outside it)
  • CVE-2026-24131
    Affects 6.34.0 to 10.28.1 (10.28.2 is outside it)
  • CVE-2026-24056
    Affects 6.34.0 to 10.28.1 (10.28.2 is outside it)
  • CVE-2026-23890
    Affects 6.34.0 to 10.28.0 (10.28.1 is outside it)
  • CVE-2026-23889
    Affects 6.34.0 to 10.28.0 (10.28.1 is outside it)
  • CVE-2026-23888
    Affects 6.34.0 to 10.28.0 (10.28.1 is outside it)
  • CVE-2025-69262
    Affects 6.34.0 to 10.26.2 (10.27.0 is outside it)
  • CVE-2025-69264
    Affects 10.0.0 to 10.25.0 (10.26.0 is outside it)
  • CVE-2025-69263
    Affects 6.34.0 to 10.25.0 (10.26.0 is outside it)
  • CVE-2024-47829
    Affects 6.34.0 to 10.0.0-rc.3 (10.0.0 is outside it)
  • CVE-2024-53866
    Affects 6.34.0 to 9.14.4 (9.15.0 is outside it)
  • CVE-2023-37478
    Affects 6.34.0 to 7.33.3 (7.33.4 is outside it); 8.0.0 to 8.6.7 (8.6.8 is outside it)
  • CVE-2022-26183
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 31

  • pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings

    Affected: from 11.0.0, fixed in 11.11.0; from 10.7.0, fixed in 10.34.5.

    Fixed in 10.34.5 (released Jul 10, 2026, 79 days before disclosure) and 11.11.0 (released Jul 9, 2026, 80 days before disclosure).

    The latest release, 12.18.0, is not affected.

    34% of pnpm downloads last week were affected versions (114.2M).

  • pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

    Affected: fixed in 10.34.5; from 11.0.0, fixed in 11.11.0.

    Fixed in 10.34.5 (released Jul 10, 2026, 52 days before disclosure) and 11.11.0 (released Jul 9, 2026, 53 days before disclosure).

    The latest release, 12.18.0, is not affected.

    46% of pnpm downloads last week were affected versions (155.6M).

  • pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

    Affected: fixed in 10.34.5; from 11.0.0, fixed in 11.11.0.

    Fixed in 10.34.5 (released Jul 10, 2026, 52 days before disclosure) and 11.11.0 (released Jul 9, 2026, 53 days before disclosure).

    The latest release, 12.18.0, is not affected.

    46% of pnpm downloads last week were affected versions (155.6M).

  • pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

    Affected: fixed in 10.34.4; from 11.0.0, fixed in 11.8.0.

    Fixed in 10.34.4 (released Jun 18, 2026, 18 days before disclosure) and 11.8.0 (released Jun 18, 2026, 18 days before disclosure).

    The latest release, 12.18.0, is not affected.

    43% of pnpm downloads last week were affected versions (147.1M).

  • pnpm: hoisted install imports lockfile alias outside node_modules

    Affected: fixed in 10.34.4; from 11.0.0, fixed in 11.7.0.

    Fixed in 10.34.4 (released Jun 18, 2026, 18 days before disclosure) and 11.7.0 (released Jun 15, 2026, 21 days before disclosure).

    The latest release, 12.18.0, is not affected.

    42% of pnpm downloads last week were affected versions (141.5M).

  • pnpm: patch-remove could delete project-selected files outside the patches directory

    Affected: fixed in 10.34.4; from 11.0.0, fixed in 11.7.0.

    Fixed in 10.34.4 (released Jun 18, 2026, 18 days before disclosure) and 11.7.0 (released Jun 15, 2026, 21 days before disclosure).

    The latest release, 12.18.0, is not affected.

    42% of pnpm downloads last week were affected versions (141.5M).

  • CVE-2026-55180Medium 6.5

    pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

    Affected: fixed in 10.34.2; from 11.0.0, fixed in 11.5.3.

    Fixed in 10.34.2 (released Jun 10, 2026, 15 days before disclosure) and 11.5.3 (released Jun 10, 2026, 15 days before disclosure).

    The latest release, 12.18.0, is not affected.

    41% of pnpm downloads last week were affected versions (139.1M).

  • CVE-2026-48995Medium 4.8

    pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

    Affected: fixed in 10.33.4; from 11.0.0, fixed in 11.0.7.

    Fixed in 10.33.4 (released May 6, 2026, 50 days before disclosure) and 11.0.7 (released May 6, 2026, 50 days before disclosure).

    The latest release, 12.18.0, is not affected.

    35% of pnpm downloads last week were affected versions (118.6M).

  • CVE-2026-50017Medium 6.9

    pnpm binds unscoped user-level npm auth credentials to a repository-selected registry

    Affected: fixed in 10.34.0; from 11.0.0, fixed in 11.4.0.

    Fixed in 10.34.0 (released May 27, 2026, 29 days before disclosure) and 11.4.0 (released May 27, 2026, 29 days before disclosure).

    The latest release, 12.18.0, is not affected.

    40% of pnpm downloads last week were affected versions (133.9M).

  • pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

    Affected: fixed in 10.34.0; from 11.0.0, fixed in 11.4.0.

    Fixed in 10.34.0 (released May 27, 2026, 29 days before disclosure) and 11.4.0 (released May 27, 2026, 29 days before disclosure).

    The latest release, 12.18.0, is not affected.

    40% of pnpm downloads last week were affected versions (133.9M).

  • pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

    Affected: fixed in 10.34.0; from 11.0.0, fixed in 11.4.0.

    Fixed in 10.34.0 (released May 27, 2026, 29 days before disclosure) and 11.4.0 (released May 27, 2026, 29 days before disclosure).

    The latest release, 12.18.0, is not affected.

    40% of pnpm downloads last week were affected versions (133.9M).

  • CVE-2026-50014Medium 6.4

    pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

    Affected: fixed in 10.34.0; from 11.0.0, fixed in 11.4.0.

    Fixed in 10.34.0 (released May 27, 2026, 29 days before disclosure) and 11.4.0 (released May 27, 2026, 29 days before disclosure).

    The latest release, 12.18.0, is not affected.

    40% of pnpm downloads last week were affected versions (133.9M).

  • CVE-2026-50573Medium 6.8

    pnpm: Unsafe default behavior breaks integrity check

    Affected: fixed in 10.34.0; from 11.0.0, fixed in 11.4.0.

    Fixed in 10.34.0 (released May 27, 2026, 29 days before disclosure) and 11.4.0 (released May 27, 2026, 29 days before disclosure).

    The latest release, 12.18.0, is not affected.

    40% of pnpm downloads last week were affected versions (133.9M).

  • CVE-2026-50021Medium 6.8

    pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field

    Affected: from 11.0.0, fixed in 11.4.0; fixed in 10.34.1.

    Fixed in 10.34.1 (released May 27, 2026, 29 days before disclosure) and 11.4.0 (released May 27, 2026, 29 days before disclosure).

    The latest release, 12.18.0, is not affected.

    40% of pnpm downloads last week were affected versions (134M).

  • pnpm: stage download writes outside destination via manifest version traversal

    Affected: from 11.3.0, fixed in 11.5.3.

    Fixed in 11.5.3 (released Jun 10, 2026, 15 days before disclosure).

    The latest release, 12.18.0, is not affected.

    1.6% of pnpm downloads last week were affected versions (5.4M).

Show all 31 advisoriesShow fewer advisories
  • CVE-2026-55699Medium 6.5

    pnpm: reserved bin name deletes PNPM_HOME during global remove

    Affected: fixed in 10.34.2; from 11.0.0, fixed in 11.5.3.

    Fixed in 10.34.2 (released Jun 10, 2026, 15 days before disclosure) and 11.5.3 (released Jun 10, 2026, 15 days before disclosure).

    The latest release, 12.18.0, is not affected.

    41% of pnpm downloads last week were affected versions (139.1M).

  • pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

    Affected: fixed in 10.34.2; from 11.0.0, fixed in 11.5.3.

    Fixed in 10.34.2 (released Jun 10, 2026, 15 days before disclosure) and 11.5.3 (released Jun 10, 2026, 15 days before disclosure).

    The latest release, 12.18.0, is not affected.

    41% of pnpm downloads last week were affected versions (139.1M).

  • pnpm: Repository-controlled configDependencies can select a pacquet native install engine

    Affected: fixed in 10.34.2; from 11.0.0, fixed in 11.5.3.

    Fixed in 10.34.2 (released Jun 10, 2026, 15 days before disclosure) and 11.5.3 (released Jun 10, 2026, 15 days before disclosure).

    The latest release, 12.18.0, is not affected.

    41% of pnpm downloads last week were affected versions (139.1M).

  • pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

    Affected: fixed in 10.34.2; from 11.0.0, fixed in 11.5.3.

    Fixed in 10.34.2 (released Jun 10, 2026, 15 days before disclosure) and 11.5.3 (released Jun 10, 2026, 15 days before disclosure).

    The latest release, 12.18.0, is not affected.

    41% of pnpm downloads last week were affected versions (139.1M).

  • CVE-2026-24131Medium 6.7

    pnpm has Path Traversal via arbitrary file permission modification

    Affected: fixed in 10.28.2.

    Fixed in 10.28.2 (released Jan 26, 2026, the day of disclosure).

    The latest release, 12.18.0, is not affected.

    25% of pnpm downloads last week were affected versions (83.3M).

  • CVE-2026-24056Medium 6.7

    pnpm has symlink traversal in file:/git dependencies

    Affected: fixed in 10.28.2.

    Fixed in 10.28.2 (released Jan 26, 2026, the day of disclosure).

    The latest release, 12.18.0, is not affected.

    25% of pnpm downloads last week were affected versions (83.3M).

  • CVE-2026-23890Medium 6.5

    pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin

    Affected: fixed in 10.28.1.

    Fixed in 10.28.1 (released Jan 19, 2026, 7 days before disclosure).

    The latest release, 12.18.0, is not affected.

    24% of pnpm downloads last week were affected versions (81.7M).

  • CVE-2026-23889Medium 6.5

    pnpm has Windows-specific tarball Path Traversal

    Affected: fixed in 10.28.1.

    Fixed in 10.28.1 (released Jan 19, 2026, 7 days before disclosure).

    The latest release, 12.18.0, is not affected.

    24% of pnpm downloads last week were affected versions (81.7M).

  • CVE-2026-23888Medium 6.5

    pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)

    Affected: fixed in 10.28.1.

    Fixed in 10.28.1 (released Jan 19, 2026, 7 days before disclosure).

    The latest release, 12.18.0, is not affected.

    24% of pnpm downloads last week were affected versions (81.7M).

  • pnpm vulnerable to Command Injection via environment variable substitution

    Affected: from 6.25.0, fixed in 10.27.0.

    Fixed in 10.27.0 (released Dec 30, 2025, 8 days before disclosure).

    The latest release, 12.18.0, is not affected.

    22% of pnpm downloads last week were affected versions (74.9M).

  • pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"

    Affected: from 10.0.0, fixed in 10.26.0.

    Fixed in 10.26.0 (released Dec 15, 2025, 23 days before disclosure).

    The latest release, 12.18.0, is not affected.

    11% of pnpm downloads last week were affected versions (37.3M).

  • pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies

    Affected: fixed in 10.26.0.

    Fixed in 10.26.0 (released Dec 15, 2025, 23 days before disclosure).

    The latest release, 12.18.0, is not affected.

    22% of pnpm downloads last week were affected versions (72.9M).

  • CVE-2024-47829Medium 6.5

    pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting

    Affected: fixed in 10.0.0.

    Fixed in 10.0.0 (released Jan 7, 2025, 106 days before disclosure).

    The latest release, 12.18.0, is not affected.

    11% of pnpm downloads last week were affected versions (35.6M).

  • CVE-2024-53866Medium 5.8

    pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion

    Affected: fixed in 9.15.0.

    Fixed in 9.15.0 (released Dec 6, 2024, 4 days before disclosure).

    The latest release, 12.18.0, is not affected.

    4.3% of pnpm downloads last week were affected versions (14.5M).

  • pnpm incorrectly parses tar archives relative to specification

    Affected: fixed in 7.33.4; from 8.0.0, fixed in 8.6.8.

    Fixed in 7.33.4 (released Jul 17, 2023, 15 days before disclosure) and 8.6.8 (released Jul 17, 2023, 15 days before disclosure).

    The latest release, 12.18.0, is not affected.

    0.2% of pnpm downloads last week were affected versions (557.2K).

  • PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when…

    Affected: fixed in 6.15.1.

    Fixed in 6.15.1.

    The latest release, 12.18.0, is not affected.

    <0.1% of pnpm downloads last week were affected versions (61.6K).