pnpm up to 10.33.x/11.3.x pnpm-lock.yaml Integrity integrity check

Summaryinfo

A vulnerability was found in pnpm up to 10.33.x/11.3.x. It has been classified as problematic. The affected element is an unknown function of the file pnpm-lock.yaml. The manipulation of the argument Integrity leads to integrity check. This vulnerability is listed as CVE-2026-50021. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in pnpm up to 10.33.x/11.3.x and classified as problematic. This issue affects an unknown code block of the file pnpm-lock.yaml. The manipulation of the argument integrity with an unknown input leads to a integrity check vulnerability. Using CWE to declare the problem leads to CWE-354. The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's tarball extraction worker skips integrity verification when the integrity field is absent from the lockfile resolution. If an attacker can both modify pnpm-lock.yaml to remove the integrity: field and cause the referenced registry URL to serve altered package content, pnpm install --frozen-lockfile can install the altered package without an integrity error. npm's npm ci enforces integrity by default; pnpm's behavior of silently skipping verification is a pnpm-specific fail-open gap. This vulnerability is fixed in 10.34.0 and 11.4.0.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-50021 since 06/03/2026. The exploitation is known to be difficult. The attack may be initiated remotely. Technical details are known, but no exploit is available.

Upgrading to version 10.34.0 or 11.4.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• pnpm

Version

• 10.0
• 10.1
• 10.2
• 10.3
• 10.4
• 10.5
• 10.6
• 10.7
• 10.8
• 10.9
• 10.10
• 10.11
• 10.12
• 10.13
• 10.14
• 10.15
• 10.16
• 10.17
• 10.18
• 10.19
• 10.20
• 10.21
• 10.22
• 10.23
• 10.24
• 10.25
• 10.26
• 10.27
• 10.28
• 10.29
• 10.30
• 10.31
• 10.32
• 10.33
• 11.0
• 11.1
• 11.2
• 11.3

Website

• Product: https://github.com/pnpm/pnpm/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion