CVE-2026-50014 Details
Description
pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm passes the lockfile-controlled git resolution.commit value to git fetch without a -- separator or commit-format validation. For git dependencies fetched through the shallow-fetch path, a malicious lockfile can replace the expected 40-character commit hash with a Git option such as --upload-pack=<command>. For SSH and local transports, --upload-pack can execute the supplied command. HTTPS transports ignore --upload-pack, so the practical attack surface is primarily SSH or local git dependencies. This vulnerability is fixed in 10.34.0 and 11.4.0.
A vulnerability in pnpm, a package manager, exists in versions prior to 10.34.0 and 11.4.0. The issue arises because pnpm passes the lockfile-controlled git resolution.commit value to git fetch without proper validation or a separator, allowing for injection of Git options. This vulnerability can be exploited for git dependencies fetched through the shallow-fetch path, where a malicious lockfile can replace the expected commit hash with an option that executes a command via Git. The practical attack surface is primarily for SSH or local transports, as HTTPS ignores the injected options.
Users can upgrade to pnpm versions 10.34.0 or 11.4.0 and later. For those using vulnerable versions, it is recommended to manually validate and sanitize git commit values in the lockfile before installation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pnpm/pnpm/security/advisories/GHSA-p4xf-rf54-rj3x | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/pnpm/pnpm/security/advisories/GHSA-p4xf-rf54-rj3x | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pnpm pnpm | < 10.34.0 >= 11.0.0, < 11.4.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |