pnpm EUVD-2026-39497

Exploitation requires all of the following to be true simultaneously: (1) the target project declares at least one dependency sourced from https://codeload.github.com (i.e., a GitHub repository specified in package.json using the user/repo or github:user/repo syntax); (2) pnpm version is prior to 10.33.4 (v10) or 11.0.7 (v11); (3) the attacker has compromised the codeload.github.com server itself OR has achieved network interception capability between the developer and that domain (DNS poisoning, BGP hijack, rogue proxy, or compromised machine DNS/hosts configuration); and (4) the developer actively runs pnpm install or a command that triggers dependency resolution. This vulnerability does NOT affect npm-registry-sourced packages, which maintain separate integrity verification. Exploitation is limited by the high complexity of gaining a trusted network position or compromising GitHub infrastructure.

The CVSS 4.0 score of 4.8 reflects two significant mitigating factors encoded in the vector: AC:H (exploitation requires a compromised codeload.github.com server or an attacker with network interception capability such as DNS poisoning or a rogue proxy) and UI:A (a developer must actively run pnpm install). These factors substantially limit opportunistic exploitation - this is not a trivially mass-exploitable vulnerability. The E:U modifier in the provided CVSS 4.0 vector confirms no reported exploitation, and the absence from CISA KEV is consistent with this. EPSS data was not provided in the source intelligence. That said, the raw impact metrics (VC:H/VI:H/VA:H) reflect that successful exploitation results in total compromise of the developer's system, which can cascade into CI/CD pipeline compromise, credential theft, and poisoned build artifacts. Real-world priority is moderate for typical organizations, but elevated for high-value targets (prominent open-source maintainers, enterprises with sensitive IP in build pipelines) where supply chain attacks are a credible threat model.

An attacker who has compromised codeload.github.com infrastructure - or established a man-in-the-middle position via DNS poisoning, BGP hijack, or a rogue proxy in a developer's network path - substitutes a malicious tarball for a legitimate GitHub dependency. When a developer on an affected pnpm version runs pnpm install, pnpm fetches and installs the poisoned package without comparing its content against any stored hash, executing attacker-controlled postinstall scripts with the developer's OS privileges. No public proof-of-concept exploit has been identified at the time of this analysis.