Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how pnpm compares to other vendors in security performance

View Risk Score →

PNPM Pnpm Node.jspnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

Risk 53
Severity
8.2
First published (updated )
CVE-2026-59195

PNPM Pnpm Node.jspnpm: hoisted install imports lockfile alias outside node_modules

Risk 47
Severity
7.1
First published (updated )
CVE-2026-59196

PNPM Pnpm Node.jspnpm: patch-remove could delete project-selected files outside the patches directory

Risk 47
Severity
7.1
First published (updated )
CVE-2026-59194

npm/pnpmpnpm: Repository config can expand victim environment secrets into registry requests before scripts run

Risk 37
Severity
6.5
First published (updated )
CVE-2026-55180

pnpmpnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

Risk 69
Severity
4.8
First published (updated )
CVE-2026-48995
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

npm/pnpmpnpm binds unscoped user-level npm auth credentials to a repository-selected registry

Risk 41
Severity
6.9
First published (updated )
CVE-2026-50017

npm/pnpmpnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

Risk 77
Severity
8.8
First published (updated )
CVE-2026-50016

npm/pnpmpnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

Risk 54
Severity
7.3
First published (updated )
CVE-2026-50015

npm/pnpmpnpm: Git Fetch Argument Injection via Lockfile resolution.commit

Risk 54
Severity
7.3
First published (updated )
CVE-2026-50014

npm/pnpmpnpm: Unsafe default behavior breaks integrity check

Risk 59
Severity
8.1
First published (updated )
CVE-2026-50573
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

npm/pnpmpnpm: Integrity Check Bypass via Missing Lockfile Integrity Field

Risk 60
Severity
8.1
First published (updated )
CVE-2026-50021

pnpm/pnpmpnpm: stage download writes outside destination via manifest version traversal

Risk 47
Severity
7.1
First published (updated )
CVE-2026-55700

npm/pnpmpnpm: reserved bin name deletes PNPM_HOME during global remove

Risk 37
Severity
6.5
First published (updated )
CVE-2026-55699

npm/pnpmpnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

Risk 77
Severity
8.8
First published (updated )
CVE-2026-55698

npm/pnpmpnpm: Repository-controlled configDependencies can select a pacquet native install engine

Risk 77
Severity
8.8
First published (updated )
CVE-2026-55697
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

npm/pnpmpnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

Risk 77
Severity
8.8
First published (updated )
CVE-2026-55487

npm/pnpmpnpm has Path Traversal via arbitrary file permission modification

Risk 27
Severity
6.7
EPSS
0.01%
First published (updated )
CVE-2026-24131

npm/pnpmpnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)

Risk 27
Severity
6.5
EPSS
0.01%
First published (updated )
CVE-2026-23888

npm/pnpmpnpm has Windows-specific tarball Path Traversal

Risk 27
Severity
6.5
EPSS
0.01%
First published (updated )
CVE-2026-23889

npm/pnpmpnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin

Risk 27
Severity
6.5
EPSS
0.01%
First published (updated )
CVE-2026-23890
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

npm/pnpmpnpm has symlink traversal in file:/git dependencies

Risk 27
Severity
6.7
EPSS
0.01%
First published (updated )
CVE-2026-24056

npm/pnpmpnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"

Risk 91
Severity
9.8
First published (updated )
CVE-2025-69264

npm/pnpmpnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies

Risk 82
Severity
8.8
First published (updated )
CVE-2025-69263

npm/pnpmpnpm vulnerable to Command Injection via environment variable substitution

Risk 69
Severity
7.8
First published (updated )
CVE-2025-69262

npm/pnpmpnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting

Risk 48
Severity
6.5
First published (updated )
CVE-2024-47829
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

npm/pnpmpnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion

Risk 89
Severity
5.8
First published (updated )
CVE-2024-53866

npm/@pnpm/win-x64pnpm incorrectly parses tar archives relative to specification

Risk 87
Severity
9.8
First published (updated )
CVE-2023-37478

npm/pnpmPNPM prior to v6.15.1 was discovered to contain an untrusted search path which causes the applicatio…

Risk 80
Severity
8.8
First published (updated )
CVE-2022-26183

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203