pnpm records

28 published records for vendor pnpm.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 3
With a fix record: 100%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

28 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2023-37478Proof of concept	pnpm incorrectly parses tar archives relative to specificationpnpm · pnpm · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	1.2%	Aug 1, 2023
39Monitor	CVE-2025-69264No exploit	pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"pnpm · pnpm · CWE-693 pre-auth RCE	Critical9.8	—	1.0%	Jan 7, 2026
35Monitor	CVE-2022-26183No exploit	PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when usepnpm · pnpm · CWE-426	High8.8	—	1.5%	Mar 21, 2022
35Monitor	CVE-2026-50016No exploit	pnpm: Transitive dependency alias path traversal allows project path override via symlink replacementpnpm · pnpm · CWE-23 Pre-auth Path traversal	High8.8	—	0.5%	Jun 25, 2026
35Monitor	CVE-2025-69263No exploit	pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependenciespnpm · pnpm · CWE-494 Pre-auth	High8.8	—	0.4%	Jan 7, 2026
35Monitor	CVE-2026-55698No exploit	pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytespnpm · pnpm · CWE-345 Pre-auth	High8.8	—	0.2%	Jun 25, 2026
35Monitor	CVE-2026-55697No exploit	pnpm: Repository-controlled configDependencies can select a pacquet native install enginepnpm · pnpm · CWE-78 pre-auth RCE Command injection	High8.8	—	0.1%	Jun 25, 2026
35Monitor	CVE-2026-55487No exploit	pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecyclepnpm · pnpm · CWE-346 Pre-auth	High8.8	—	0.1%	Jun 25, 2026
32Monitor	CVE-2026-59195No exploit	pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-configpnpm · pnpm · CWE-22 Pre-auth Path traversal	High8.2	—	0.4%	Jul 6, 2026
32Monitor	CVE-2026-50021No exploit	pnpm: Integrity Check Bypass via Missing Lockfile Integrity Fieldpnpm · pnpm · CWE-354	High8.1	—	0.1%	Jun 25, 2026
32Monitor	CVE-2026-50573No exploit	pnpm: Unsafe default behavior breaks integrity checkpnpm · pnpm · CWE-345 Pre-auth	High8.1	—	0.1%	Jun 25, 2026
31Monitor	CVE-2025-69262No exploit	pnpm vulnerable to Command Injection via environment variable substitutionpnpm · pnpm · CWE-78 RCE Command injection	High7.8	—	1.0%	Jan 7, 2026
29Monitor	CVE-2026-50015No exploit	pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)pnpm · pnpm · CWE-22 Path traversal	High7.3	—	0.4%	Jun 25, 2026
29Monitor	CVE-2026-50014No exploit	pnpm: Git Fetch Argument Injection via Lockfile resolution.commitpnpm · pnpm · CWE-88	High7.3	—	0.3%	Jun 25, 2026
28Monitor	CVE-2026-55700No exploit	pnpm: stage download writes outside destination via manifest version traversalpnpm · pnpm · CWE-22 Pre-auth Path traversal	High7.1	—	0.4%	Jun 25, 2026
28Monitor	CVE-2026-59196No exploit	pnpm: hoisted install imports lockfile alias outside node_modulespnpm · pnpm · CWE-22 Pre-auth Path traversal	High7.1	—	0.4%	Jul 6, 2026
28Monitor	CVE-2026-59194No exploit	pnpm: patch-remove could delete project-selected files outside the patches directorypnpm · pnpm · CWE-22 Pre-auth Path traversal	High7.1	—	0.4%	Jul 6, 2026
27Monitor	CVE-2026-50017No exploit	pnpm binds unscoped user-level npm auth credentials to a repository-selected registrypnpm · pnpm · CWE-200 Pre-auth Info leak	Medium6.9	—	0.4%	Jun 25, 2026
26Monitor	CVE-2026-24056No exploit	pnpm has symlink traversal in file:/git dependenciespnpm · pnpm · CWE-22 Path traversal	Medium6.7	—	0.5%	Jan 26, 2026
26Monitor	CVE-2026-23890No exploit	pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.binpnpm · pnpm · CWE-23 Pre-auth Path traversal	Medium6.5	—	0.5%	Jan 26, 2026
26Monitor	CVE-2026-23889No exploit	pnpm has Windows-specific tarball Path Traversalpnpm · pnpm · CWE-22 Pre-auth Path traversal	Medium6.5	—	0.4%	Jan 26, 2026
26Monitor	CVE-2026-23888No exploit	pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)pnpm · pnpm · CWE-22 Pre-auth Path traversal	Medium6.5	—	0.4%	Jan 26, 2026
26Monitor	CVE-2026-55699No exploit	pnpm: reserved bin name deletes PNPM_HOME during global removepnpm · pnpm · CWE-22 Pre-auth Path traversal Denial of service	Medium6.5	—	0.4%	Jun 25, 2026
26Monitor	CVE-2026-55180No exploit	pnpm: Repository config can expand victim environment secrets into registry requests before scripts runpnpm · pnpm · CWE-200 Pre-auth Info leak	Medium6.5	—	0.3%	Jun 25, 2026
26Monitor	CVE-2026-24131No exploit	pnpm has Path Traversal via arbitrary file permission modificationpnpm · pnpm · CWE-22 Path traversal	Medium6.7	—	0.2%	Jan 26, 2026

CVE-2023-37478
39Monitor
pnpm incorrectly parses tar archives relative to specification
CriticalCVSS 9.8Proof of conceptEPSS 1%
- Pre-auth
- Broken access control (IDOR)
pnpm · pnpmAug 1, 2023
CVE-2025-69264
39Monitor
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
pnpm · pnpmJan 7, 2026
CVE-2022-26183
35Monitor
PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when use
HighCVSS 8.8No exploitEPSS 1%
pnpm · pnpmMar 21, 2022
CVE-2026-50016
35Monitor
pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Path traversal
pnpm · pnpmJun 25, 2026
CVE-2025-69263
35Monitor
pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
pnpm · pnpmJan 7, 2026
CVE-2026-55698
35Monitor
pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
pnpm · pnpmJun 25, 2026
CVE-2026-55697
35Monitor
pnpm: Repository-controlled configDependencies can select a pacquet native install engine
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Command injection
pnpm · pnpmJun 25, 2026
CVE-2026-55487
35Monitor
pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
pnpm · pnpmJun 25, 2026
CVE-2026-59195
32Monitor
pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
pnpm · pnpmJul 6, 2026
CVE-2026-50021
32Monitor
pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field
HighCVSS 8.1No exploitEPSS 0%
pnpm · pnpmJun 25, 2026
CVE-2026-50573
32Monitor
pnpm: Unsafe default behavior breaks integrity check
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
pnpm · pnpmJun 25, 2026
CVE-2025-69262
31Monitor
pnpm vulnerable to Command Injection via environment variable substitution
HighCVSS 7.8No exploitEPSS 1%
- RCE
- Command injection
pnpm · pnpmJan 7, 2026
CVE-2026-50015
29Monitor
pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)
HighCVSS 7.3No exploitEPSS 0%
- Path traversal
pnpm · pnpmJun 25, 2026
CVE-2026-50014
29Monitor
pnpm: Git Fetch Argument Injection via Lockfile resolution.commit
HighCVSS 7.3No exploitEPSS 0%
pnpm · pnpmJun 25, 2026
CVE-2026-55700
28Monitor
pnpm: stage download writes outside destination via manifest version traversal
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Path traversal
pnpm · pnpmJun 25, 2026
CVE-2026-59196
28Monitor
pnpm: hoisted install imports lockfile alias outside node_modules
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Path traversal
pnpm · pnpmJul 6, 2026
CVE-2026-59194
28Monitor
pnpm: patch-remove could delete project-selected files outside the patches directory
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Path traversal
pnpm · pnpmJul 6, 2026
CVE-2026-50017
27Monitor
pnpm binds unscoped user-level npm auth credentials to a repository-selected registry
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
- Info leak
pnpm · pnpmJun 25, 2026
CVE-2026-24056
26Monitor
pnpm has symlink traversal in file:/git dependencies
MediumCVSS 6.7No exploitEPSS 0%
- Path traversal
pnpm · pnpmJan 26, 2026
CVE-2026-23890
26Monitor
pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- Path traversal
pnpm · pnpmJan 26, 2026
CVE-2026-23889
26Monitor
pnpm has Windows-specific tarball Path Traversal
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- Path traversal
pnpm · pnpmJan 26, 2026
CVE-2026-23888
26Monitor
pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- Path traversal
pnpm · pnpmJan 26, 2026
CVE-2026-55699
26Monitor
pnpm: reserved bin name deletes PNPM_HOME during global remove
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- Path traversal
- Denial of service
pnpm · pnpmJun 25, 2026
CVE-2026-55180
26Monitor
pnpm: Repository config can expand victim environment secrets into registry requests before scripts run
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- Info leak
pnpm · pnpmJun 25, 2026
CVE-2026-24131
26Monitor
pnpm has Path Traversal via arbitrary file permission modification
MediumCVSS 6.7No exploitEPSS 0%
- Path traversal
pnpm · pnpmJan 26, 2026