Is CVE-2026-48995 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48995 being exploited in the wild.

How severe is CVE-2026-48995?

Medium severity, with a CVSS score of 4, published 25 June 2026.

Which products and versions are affected?

pnpm (npm) SEMVER:introduced=0,fixed=10.33.4.

Is there a fix for CVE-2026-48995?

Yes. pnpm (npm): upgrade to 10.33.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48995 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48995?

Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48995: pnpm missing integrity check for GitHub dependencies

CVE-2026-48995 · Severity: medium · CVSS 4 · Published 2026-06-25

pnpm, a popular JavaScript package manager, fails to verify the integrity of dependencies downloaded directly from GitHub. This flaw could allow a compromised server or a local machine configuration to substitute legitimate software with malicious code without the user's knowledge. If exploited, this could lead to the installation of malware or unauthorized access to development environments and production systems.

Technologies: pnpm (npm). Vendors: npm.

Quick answers

Is CVE-2026-48995 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48995 being exploited in the wild.
How severe is CVE-2026-48995?: Medium severity, with a CVSS score of 4, published 25 June 2026.
Which products and versions are affected?: pnpm (npm) SEMVER:introduced=0,fixed=10.33.4.
Is there a fix for CVE-2026-48995?: Yes. pnpm (npm): upgrade to 10.33.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48995 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48995?: Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pnpm (npm): upgrade to 10.33.4 or later
```
npm install pnpm@10.33.4
```

Technical details

pnpm is vulnerable to a missing support for integrity check (CWE-353) when handling GitHub git dependencies. The lockfile (v9.0) fails to store a cryptographic hash for tarballs fetched from codeload.github.com, relying instead on the commit shorthand in the URL. An attacker who can compromise the download server or manipulate a user's network/machine configuration can serve a malicious tarball that pnpm will install without warning, as there is no hash to validate against. This affects pnpm versions prior to 10.33.4 and 11.x versions prior to 11.0.7. Patches are available in versions 10.33.4 and 11.0.7.

Affected products

pnpm pnpm < 10.33.4, >= 11.0.0 < 11.0.7

Identifiers

CVE-2026-48995
GHSA-hg3w-7f8c-63hp

Timeline

2026-05-25: disclosed: Advisory published to pnpm/pnpm repository
2026-06-25: advisory: NVD published the vulnerability
2026-06-26: patched: GitHub Advisory Database updated with patched versions

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.