| pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yamlCVE-2026-101043 · GHSA-VX52-2968-3VC6 |
pnpmRed Hat AMQ Broker 7/amq-broker-maven-repository.zip |
npmRed Hat |
High
|
Fix reported |
|
| pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasionCVE-2024-53866 · GHSA-VM32-9RQF-RH3R |
pnpm |
npm |
Medium
|
Fix reported |
|
| pnpm incorrectly parses tar archives relative to specificationCVE-2023-37478 · GHSA-5R98-F33J-G8H7 |
@pnpm/cafs@pnpm/exe |
npm |
High
|
Fix reported |
|
| pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraphCVE-2026-82392 · GHSA-C59Q-G84Q-2GJ5 |
pnpm |
npm |
High
|
Fix reported |
|
| pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on installCVE-2026-82393 · GHSA-VQ4V-J7R6-JQ4M |
pnpm |
npm |
High
|
Fix reported |
|
| pnpm: pacquet trust-lockfile install can create dependency symlinks outside the projectGHSA-2RX9-3G3H-C2JV |
pnpm |
npm |
High
|
Fix reported |
|
| pnpm: Repository-controlled configDependencies can select a pacquet native install engineCVE-2026-55697 · GHSA-GJ8W-MVPF-X27X |
pnpm |
npm |
High
|
Fix reported |
|
| pnpm: Hoisted install imports lockfile alias outside node_modulesCVE-2026-59196 · GHSA-FR4H-3CPH-29XV |
pnpm |
npm |
High
|
Fix reported |
|
| pnpm: `patch-remove` could delete project-selected files outside the patches directoryCVE-2026-59194 · GHSA-72R4-9C5J-MJ57 |
pnpm |
npm |
High
|
Fix reported |
|
| pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-configCVE-2026-59195 · GHSA-QRV3-253H-G69C |
pnpm |
npm |
High
|
Fix reported |
|
| pnpm: `stage download` writes outside its destination directory via manifest name/version traversalCVE-2026-55700 · GHSA-V23M-CCFG-PQ9H |
pnpm |
npm |
High
|
Fix reported |
|
| pnpm: Reserved bin name deletes PNPM_HOME during global removeCVE-2026-55699 · GHSA-4GXM-V5V7-FQC4 |
pnpmRed Hat AMQ Broker 7/pnpm |
npmRed Hat |
Medium
|
Fix reported |
|
| pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytesCVE-2026-55698 · GHSA-W466-C33R-3GJP |
pnpm |
npm |
High
|
Fix reported |
|
| pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycleCVE-2026-55487 · GHSA-5WX6-MG75-V57R |
pnpm |
npm |
High
|
Fix reported |
|
| pnpm: Repository config can expand victim environment secrets into registry requests before scripts runCVE-2026-55180 · GHSA-3QHV-2RGH-X77R |
pnpmRed Hat AMQ Broker 7/pnpm |
npmRed Hat |
Medium
|
Fix reported |
|
| pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)CVE-2026-50015 · GHSA-RXHJ-4M44-96R4 |
pnpm |
npm |
High
|
Fix reported |
|
| pnpm binds unscoped user-level npm auth credentials to a repository-selected registryCVE-2026-50017 · GHSA-CJHR-43R9-CFMW |
pnpmRed Hat AMQ Broker 7/pnpm |
npmRed Hat |
Medium
|
Fix reported |
|
| pnpm: Transitive dependency alias path traversal allows project path override via symlink replacementCVE-2026-50016 · GHSA-HWX4-2J3J-G496 |
pnpm |
npm |
High
|
Fix reported |
|
| pnpm: Unsafe default behavior breaks integrity checkCVE-2026-50573 · GHSA-54HH-G5MX-JQCP |
pnpmRed Hat AMQ Broker 7/pnpm |
npmRed Hat |
Medium
|
Fix reported |
|
| pnpm: Git Fetch Argument Injection via Lockfile resolution.commitCVE-2026-50014 · GHSA-P4XF-RF54-RJ3X |
pnpmRed Hat AMQ Broker 7/pnpm |
npmRed Hat |
Medium
|
Fix reported |
|
