Executive brief
pnpm is a popular package manager for JavaScript projects. A vulnerability exists where a malicious project configuration file (lockfile) can trick pnpm into executing arbitrary commands on a developer's machine during the installation process. This occurs when a project uses specific Git-based dependencies, potentially allowing an attacker to gain control over the developer's environment or steal sensitive data.
Technical details
An argument injection vulnerability exists in pnpm's Git fetcher component (fetching/git-fetcher/src/index.ts). The application passes the 'resolution.commit' value from the pnpm-lock.yaml file directly to 'git fetch' and 'git checkout' commands without using a '--' positional argument separator or validating the commit hash format. An attacker can craft a lockfile where the commit hash is replaced with Git options like '--upload-pack=<command>'. When pnpm performs a shallow fetch over SSH or local transports, Git executes the injected command. This vulnerability requires the victim to run 'pnpm install' on a project with a malicious lockfile using SSH or local Git transports; HTTPS transports are not affected. Patches are available in versions 10.34.0 and 11.4.0.
Affected products
- pnpm pnpm < 10.34.0, >= 11.0.0 < 11.4.0
Timeline
- 2026-05-28: disclosed
- 2026-06-25: advisory: NVD publication
- 2026-06-26: patched: GitHub Advisory published/updated with patch versions