Executive brief
pnpm is a package manager used by developers to manage project dependencies. A vulnerability exists where a malicious project repository can include a specially crafted lockfile that tricks pnpm into downloading and executing malicious code instead of the official pnpm tool. If a developer or automated system runs pnpm within such a repository, an attacker could gain full control over the user's environment, potentially stealing secrets or compromising the software build process.
Technical details
A vulnerability in pnpm's automatic version switching mechanism allows for arbitrary code execution. The `switchCliVersion()` function trusted `packageManagerDependencies` entries in the `pnpm-lock.yaml` file if the versions matched the requested pnpm version, bypassing fresh resolution from trusted registries. An attacker can commit a malicious lockfile with poisoned integrity hashes and package metadata. When a victim runs pnpm in the malicious repository, pnpm installs and executes the attacker-controlled binary. The fix involves forcing a re-resolution of package-manager metadata through trusted registries before execution, even if the lockfile appears to satisfy the version requirements.
Affected products
- pnpm pnpm < 10.34.2, >= 11.0.0, < 11.5.3
- pnpm @pnpm/installing.env-installer < 10.34.2, >= 11.0.0, < 11.5.3
Timeline
- 2026-06-15: disclosed
- 2026-06-26: advisory