pnpm EUVD-2026-39490

Exploitation requires three concrete conditions: (1) the attacker must control the contents of pnpm-lock.yaml, specifically the resolution.commit field of a git dependency (e.g., via a malicious PR or compromised repo); (2) that git dependency must be fetched over SSH or local (file://) git transport AND go through pnpm's shallow-fetch path - HTTPS transport ignores --upload-pack and is NOT exploitable; and (3) a victim must run pnpm install (UI:R) on pnpm older than 10.34.0 or 11.0.0-11.3.x. Limiting factors that reduce real-world risk: the requirement for write/influence over the lockfile, the requirement for non-default SSH or local git transport (HTTPS, the common case, is immune), the need for victim-initiated install, and the absence of active exploitation (SSVC 'poc', no KEV, EPSS 0.17%).

Signals are moderate and internally consistent rather than alarming. CVSS 3.1 is 7.3 (High) with vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, but the real-world gating factors are significant: the attacker must control the contents of pnpm-lock.yaml, the affected dependency must use SSH or local git transport (HTTPS - the common case - is immune), and a victim must run pnpm install. SSVC aligns with this: exploitation is 'poc' (not active), automatable 'no', and technical impact 'partial'. EPSS is low (0.17%, percentile 7%), and there is no CISA KEV listing, indicating no evidence of widespread active exploitation. The published vector's AC:L arguably understates difficulty given the required non-default SSH/local transport, which makes the practical complexity higher; the official A:N also understates impact since arbitrary command execution typically threatens availability. Net assessment: a credible, working developer-machine RCE worth prompt patching in CI/CD and developer fleets, but not an emergency internet-facing exposure - it depends on a poisoned lockfile and non-default transport.

An attacker who can influence a project's pnpm-lock.yaml - for example via a malicious pull request, a compromised dependency, or a poisoned shared repository - edits a git dependency entry that resolves over SSH or local transport and replaces the 40-character commit hash with --upload-pack=<malicious command>. When a developer or CI runner subsequently runs pnpm install, pnpm's shallow-fetch path passes that value to git fetch, and Git executes the attacker's command as the user running install. A working proof-of-concept exists that creates a local bare repo and triggers the path to run an injected touch command.