# cve.now: Pnpm

The newest entries naming Pnpm as an affected vendor (up to 200), of 31 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-101044](https://cve.now/CVE-2026-101044.md): pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias (CVSS 7.1)
- [CVE-2026-101043](https://cve.now/CVE-2026-101043.md): pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings (CVSS 8.3)
- [CVE-2026-82393](https://cve.now/CVE-2026-82393.md): pnpm: A tarball dependency's manifest \`name\` escapes node\_modules → arbitrary file write/overwrite on install (CVSS 7.5)
- [CVE-2026-82392](https://cve.now/CVE-2026-82392.md): pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph (CVSS 7.1)
- [CVE-2026-59195](https://cve.now/CVE-2026-59195.md): pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node\_modules/.pnpm-config (CVSS 8.2)
- [CVE-2026-59196](https://cve.now/CVE-2026-59196.md): pnpm: hoisted install imports lockfile alias outside node\_modules (CVSS 7.1)
- [CVE-2026-59194](https://cve.now/CVE-2026-59194.md): pnpm: patch-remove could delete project-selected files outside the patches directory (CVSS 7.1)
- [CVE-2026-55180](https://cve.now/CVE-2026-55180.md): pnpm: Repository config can expand victim environment secrets into registry requests before scripts run (CVSS 6.5)
- [CVE-2026-48995](https://cve.now/CVE-2026-48995.md): pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile (CVSS 4.8)
- [CVE-2026-50017](https://cve.now/CVE-2026-50017.md): pnpm binds unscoped user-level npm auth credentials to a repository-selected registry (CVSS 6.9)
- [CVE-2026-50016](https://cve.now/CVE-2026-50016.md): pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement (CVSS 8.8)
- [CVE-2026-50015](https://cve.now/CVE-2026-50015.md): pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal) (CVSS 7.3)
- [CVE-2026-50014](https://cve.now/CVE-2026-50014.md): pnpm: Git Fetch Argument Injection via Lockfile resolution.commit (CVSS 6.4)
- [CVE-2026-50573](https://cve.now/CVE-2026-50573.md): pnpm: Unsafe default behavior breaks integrity check (CVSS 6.8)
- [CVE-2026-50021](https://cve.now/CVE-2026-50021.md): pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field (CVSS 6.8)
- [CVE-2026-55700](https://cve.now/CVE-2026-55700.md): pnpm: stage download writes outside destination via manifest version traversal (CVSS 7.1)
- [CVE-2026-55699](https://cve.now/CVE-2026-55699.md): pnpm: reserved bin name deletes PNPM\_HOME during global remove (CVSS 6.5)
- [CVE-2026-55698](https://cve.now/CVE-2026-55698.md): pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes (CVSS 8.8)
- [CVE-2026-55697](https://cve.now/CVE-2026-55697.md): pnpm: Repository-controlled configDependencies can select a pacquet native install engine (CVSS 7.5)
- [CVE-2026-55487](https://cve.now/CVE-2026-55487.md): pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle (CVSS 7.5)
- [CVE-2026-24131](https://cve.now/CVE-2026-24131.md): pnpm has Path Traversal via arbitrary file permission modification (CVSS 6.7)
- [CVE-2026-24056](https://cve.now/CVE-2026-24056.md): pnpm has symlink traversal in file:/git dependencies (CVSS 6.7)
- [CVE-2026-23890](https://cve.now/CVE-2026-23890.md): pnpm scoped bin name Path Traversal allows arbitrary file creation outside node\_modules/.bin (CVSS 6.5)
- [CVE-2026-23889](https://cve.now/CVE-2026-23889.md): pnpm has Windows-specific tarball Path Traversal (CVSS 6.5)
- [CVE-2026-23888](https://cve.now/CVE-2026-23888.md): pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip) (CVSS 6.5)
- [CVE-2025-69262](https://cve.now/CVE-2025-69262.md): pnpm vulnerable to Command Injection via environment variable substitution (CVSS 7.6)
- [CVE-2025-69264](https://cve.now/CVE-2025-69264.md): pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default" (CVSS 8.8)
- [CVE-2025-69263](https://cve.now/CVE-2025-69263.md): pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies (CVSS 7.5)
- [CVE-2024-47829](https://cve.now/CVE-2024-47829.md): pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting (CVSS 6.5)
- [CVE-2024-53866](https://cve.now/CVE-2024-53866.md): pnpm vulnerable to no-script global cache poisoning via overrides / \`ignore-scripts\` evasion (CVSS 5.8)
- [CVE-2023-37478](https://cve.now/CVE-2023-37478.md): pnpm incorrectly parses tar archives relative to specification (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/pnpm
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.