CVE-2026-50573 Details
Description
pnpm is a package manager. Prior to 10.34.0 and 11.4.0, `pnpm install` in non-frozen mode can accept new remote package content after detecting that the downloaded tarball does not match the integrity recorded in pnpm-lock.yaml. When a package is already locked with an integrity value, and the registry later serves different metadata and tarball content for the same package name and version, pnpm initially reports an integrity mismatch. However, plain pnpm install then performs a resolution repair, accepts the registry's new integrity, updates the lockfile, installs the new content, and exits successfully. This means the lockfile integrity check does not act as a hard stop by default. This vulnerability is fixed in 10.34.0 and 11.4.0.
A vulnerability exists in the pnpm package manager, specifically in versions prior to 10.34.0 and between 11.0.0 and 11.4.0. In non-frozen mode, the 'pnpm install' command can inadvertently accept new remote package content after identifying an integrity mismatch with the downloaded tarball. When a package is locked with a specific integrity value and the registry later provides different metadata and tarball content for the same version, pnpm initially flags the integrity discrepancy. However, it then performs a resolution repair, accepts the new integrity, updates the lockfile, and successfully installs the revised content. This behavior undermines the expected reliability of the lockfile integrity check, allowing potentially untrusted package versions to be installed without user intervention.
Users can update to pnpm versions 10.34.0 or 11.4.0 and later, where this vulnerability is fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pnpm/pnpm/security/advisories/GHSA-54hh-g5mx-jqcp | CISA-ADP | ExploitVendor Advisory |
| https://github.com/pnpm/pnpm/security/advisories/GHSA-54hh-g5mx-jqcp | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pnpm pnpm | < 10.34.0 >= 11.0.0, < 11.4.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |