EUVD-2026-39497
GHSA-hg3w-7f8c-63hp
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector with high complexity because exploitation requires compromising or MITMing codeload.github.com; user interaction required as the developer must invoke pnpm install; scope unchanged as impact remains on the developer's system.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. The lockfile does not store the hash of the dependencies from https://codeload.github.com. This means that if this server was compromised or a person's machine configuration was compromised, pnpm would download and install these dependencies. This vulnerability is fixed in 10.33.4 and 11.0.7.
AnalysisAI
Missing integrity verification in pnpm's GitHub codeload dependency resolution (versions prior to 10.33.4 and 11.0.7) enables a compromised or man-in-the-middle codeload.github.com server to deliver arbitrary malicious tarballs that pnpm installs without hash validation. Any developer project that sources dependencies from GitHub via pnpm is exposed when running pnpm install on affected versions, with potential for arbitrary code execution during the install lifecycle. No public exploit code exists and there is no CISA KEV listing, but the theoretical impact includes full developer workstation compromise and downstream supply chain contamination.
Technical ContextAI
pnpm's lockfile (pnpm-lock.yaml) records integrity hashes (SHA-512) for packages fetched from npm registries, enabling tamper detection on subsequent installs. However, for dependencies sourced from https://codeload.github.com - GitHub's tarball delivery endpoint for repository archives - no such hash is stored or verified. CWE-353 (Missing Support for Integrity Check) precisely describes this root cause: the application retrieves externally-hosted content but lacks a cryptographic digest comparison against a trusted reference in the lockfile. This means the lockfile provides reproducibility (same URL is fetched) but not integrity (the content at that URL is not verified). The affected CPE is cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:*:*:*, covering all pnpm releases in both the v10 and v11 branches prior to the respective fixes.
RemediationAI
Vendor-released patches are available: upgrade pnpm to 10.33.4 or later for v10 users, or to 11.0.7 or later for v11 users. These releases introduce lockfile hash storage and verification for codeload.github.com dependencies, closing the integrity gap. Full advisory details are at https://github.com/pnpm/pnpm/security/advisories/GHSA-hg3w-7f8c-63hp. If an immediate upgrade is not feasible, the most effective compensating control is to replace GitHub codeload dependencies with equivalent published npm registry packages, which are already subject to integrity verification - this eliminates the attack surface entirely but may require packaging changes. Alternatively, pin GitHub dependencies to specific commit SHAs and audit downloaded tarballs out-of-band before committing the lockfile. Temporarily switching package managers (npm or yarn) introduces significant operational overhead and lockfile migration risk and is not recommended unless the pnpm upgrade path is genuinely blocked.
Arbitrary code execution in the pnpm package manager (versions 10.0.0 through 10.25) lets a git-hosted dependency run co
pnpm is a package manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentica
Path traversal in pnpm before 10.34.0 and 11.4.0 lets a malicious registry package smuggle '../' segments inside a trans
Arbitrary code execution in the pnpm package manager (versions prior to 10.34.2 and 11.5.3) lets a malicious repository
Arbitrary command execution in pnpm before 10.34.2 and 11.5.3 allows a malicious repository to run attacker-chosen nativ
Supply-chain integrity bypass in pnpm package manager (versions ≤10.26.2, per description; GHSA states <10.26.0) allows
PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unex
Integrity-check bypass in the pnpm package manager (versions before 10.34.0/10.34.1 and 11.0.0-11.3.x) lets tampered pac
Command injection in pnpm versions 6.25.0 through 10.26.2 allows attackers controlling environment variables to execute
Arbitrary file write and deletion in pnpm package manager (versions prior to 10.34.0 and 11.4.0) lets a malicious contri
Arbitrary command execution in pnpm before 10.34.0 and 11.4.0 allows a malicious lockfile to run code on a developer's m
Path traversal in pnpm's `pnpm stage download` command (versions 11.3.0 through 11.5.2) lets a malicious or compromised
Same weakness CWE-353 – Missing Support for Integrity Check
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today