{"schema_version":1,"title":"Pnpm vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 20 vulnerabilities in Pnpm: 0 in the last 7 days and 5 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-101044, was published on 27 September 2026. Nothing in the last four weeks, down from 2 vulnerabilities in the four before.","url":"https://junglewise.ai/threats/technologies/pnpm-pnpm","json_url":"https://junglewise.ai/threats/technologies/pnpm-pnpm.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/pnpm-pnpm","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":12,"all_time":20,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":5,"last_365_days":19},"latest":[{"cve":"CVE-2026-101044","cvss":7.1,"slug":"cve-2026-101044-pacquet-the-rust-package-manager-component-shipped-in-the-pnpm","title":"pnpm path traversal in lockfile alias validation","severity":"high","exploited":false,"published_at":"2026-09-27T18:16:30.753+00:00","url":"https://junglewise.ai/threats/cve-2026-101044-pacquet-the-rust-package-manager-component-shipped-in-the-pnpm"},{"cve":"CVE-2026-101043","cvss":7.4,"slug":"cve-2026-101043-pnpm-versions-11-0-0-before-11-11-0-and-10-7-0-before-10-34-5","title":"pnpm environment variable exfiltration via proxy settings","severity":"high","exploited":false,"published_at":"2026-09-27T18:16:29.7+00:00","url":"https://junglewise.ai/threats/cve-2026-101043-pnpm-versions-11-0-0-before-11-11-0-and-10-7-0-before-10-34-5"},{"cvss":3.1,"slug":"pnpm-environment-secret-exfiltration-via-proxy-settings-in-workspace-f6626cca","title":"pnpm environment secret exfiltration via proxy settings in workspace manifest","severity":"low","exploited":false,"published_at":"2026-09-01T19:22:42+00:00","url":"https://junglewise.ai/threats/pnpm-environment-secret-exfiltration-via-proxy-settings-in-workspace-f6626cca"},{"cve":"CVE-2026-82393","cvss":7.5,"epss":0.0063,"slug":"cve-2026-82393-pnpm-tarball-dependency-manifest-name-path-traversal-arbitrary","title":"pnpm tarball dependency manifest name path traversal arbitrary file write","severity":"high","exploited":false,"published_at":"2026-08-31T22:17:22.353+00:00","url":"https://junglewise.ai/threats/cve-2026-82393-pnpm-tarball-dependency-manifest-name-path-traversal-arbitrary"},{"cve":"CVE-2026-82392","cvss":7.1,"epss":0.0062,"slug":"cve-2026-82392-pnpm-virtual-store-linker-path-traversal-via-unvalidated-deppath","title":"pnpm virtual store linker path traversal via unvalidated depPath","severity":"high","exploited":false,"published_at":"2026-08-31T21:17:54.033+00:00","url":"https://junglewise.ai/threats/cve-2026-82392-pnpm-virtual-store-linker-path-traversal-via-unvalidated-deppath"},{"cve":"CVE-2026-59196","cvss":7.1,"epss":0.004,"slug":"cve-2026-59196-pnpm-path-traversal-via-crafted-lockfile-alias","title":"pnpm path traversal via crafted lockfile alias","severity":"high","exploited":false,"published_at":"2026-07-06T16:16:37.81+00:00","url":"https://junglewise.ai/threats/cve-2026-59196-pnpm-path-traversal-via-crafted-lockfile-alias"},{"cve":"CVE-2026-59195","cvss":8.2,"epss":0.004,"slug":"cve-2026-59195-pnpm-path-traversal-in-configdependencies-symlink-creation","title":"pnpm path traversal in configDependencies symlink creation","severity":"high","exploited":false,"published_at":"2026-07-06T16:16:37.683+00:00","url":"https://junglewise.ai/threats/cve-2026-59195-pnpm-path-traversal-in-configdependencies-symlink-creation"},{"cve":"CVE-2026-59194","cvss":7.1,"epss":0.004,"slug":"cve-2026-59194-pnpm-path-traversal-in-patch-remove-command","title":"pnpm path traversal in patch-remove command","severity":"high","exploited":false,"published_at":"2026-07-06T16:16:37.55+00:00","url":"https://junglewise.ai/threats/cve-2026-59194-pnpm-path-traversal-in-patch-remove-command"},{"cve":"CVE-2026-55699","cvss":6.5,"epss":0.0045,"slug":"cve-2026-55699-pnpm-path-traversal-and-directory-deletion-via-malicious-manifest","title":"pnpm path traversal and directory deletion via malicious manifest bin keys","severity":"medium","exploited":false,"published_at":"2026-06-25T18:16:40.96+00:00","url":"https://junglewise.ai/threats/cve-2026-55699-pnpm-path-traversal-and-directory-deletion-via-malicious-manifest"},{"cve":"CVE-2026-55698","cvss":8.8,"epss":0.003,"slug":"cve-2026-55698-pnpm-arbitrary-code-execution-via-malicious-lockfile-metadata","title":"pnpm arbitrary code execution via malicious lockfile metadata","severity":"high","exploited":false,"published_at":"2026-06-25T18:16:40.837+00:00","url":"https://junglewise.ai/threats/cve-2026-55698-pnpm-arbitrary-code-execution-via-malicious-lockfile-metadata"},{"cve":"CVE-2026-55697","cvss":7.5,"epss":0.0019,"slug":"cve-2026-55697-pnpm-os-command-injection-via-repository-controlled","title":"pnpm OS command injection via repository-controlled configDependencies","severity":"high","exploited":false,"published_at":"2026-06-25T18:16:40.707+00:00","url":"https://junglewise.ai/threats/cve-2026-55697-pnpm-os-command-injection-via-repository-controlled"},{"cve":"CVE-2026-55487","cvss":7.5,"epss":0.0018,"slug":"cve-2026-55487-pnpm-build-policy-bypass-via-opaque-locator-normalization","title":"pnpm build policy bypass via opaque locator normalization spoofing","severity":"high","exploited":false,"published_at":"2026-06-25T18:16:40.46+00:00","url":"https://junglewise.ai/threats/cve-2026-55487-pnpm-build-policy-bypass-via-opaque-locator-normalization"},{"cve":"CVE-2026-50573","cvss":6.8,"epss":0.0017,"slug":"cve-2026-50573-pnpm-insufficient-verification-of-data-authenticity-in-non-frozen","title":"pnpm insufficient verification of data authenticity in non-frozen install","severity":"medium","exploited":false,"published_at":"2026-06-25T18:16:39.687+00:00","url":"https://junglewise.ai/threats/cve-2026-50573-pnpm-insufficient-verification-of-data-authenticity-in-non-frozen"},{"cve":"CVE-2026-50021","cvss":6.8,"epss":0.0018,"slug":"cve-2026-50021-pnpm-integrity-check-bypass-in-tarball-extraction-worker","title":"pnpm integrity check bypass in tarball extraction worker","severity":"medium","exploited":false,"published_at":"2026-06-25T18:16:39.557+00:00","url":"https://junglewise.ai/threats/cve-2026-50021-pnpm-integrity-check-bypass-in-tarball-extraction-worker"},{"cve":"CVE-2026-50017","cvss":4,"epss":0.0044,"slug":"cve-2026-50017-pnpm-credential-leak-via-repository-local-registry-configuration","title":"pnpm credential leak via repository-local registry configuration","severity":"medium","exploited":false,"published_at":"2026-06-25T18:16:39.433+00:00","url":"https://junglewise.ai/threats/cve-2026-50017-pnpm-credential-leak-via-repository-local-registry-configuration"},{"cve":"CVE-2026-50016","cvss":8.8,"epss":0.0053,"slug":"cve-2026-50016-pnpm-path-traversal-via-transitive-dependency-alias","title":"pnpm path traversal via transitive dependency alias","severity":"high","exploited":false,"published_at":"2026-06-25T18:16:39.303+00:00","url":"https://junglewise.ai/threats/cve-2026-50016-pnpm-path-traversal-via-transitive-dependency-alias"},{"cve":"CVE-2026-50015","cvss":7.3,"epss":0.0043,"slug":"cve-2026-50015-pnpm-path-traversal-in-patch-application-pipeline","title":"pnpm path traversal in patch application pipeline","severity":"high","exploited":false,"published_at":"2026-06-25T18:16:39.167+00:00","url":"https://junglewise.ai/threats/cve-2026-50015-pnpm-path-traversal-in-patch-application-pipeline"},{"cve":"CVE-2026-50014","cvss":6.4,"epss":0.0032,"slug":"cve-2026-50014-pnpm-argument-injection-in-git-fetcher-via-lockfile-commit","title":"pnpm argument injection in git-fetcher via lockfile commit resolution","severity":"medium","exploited":false,"published_at":"2026-06-25T18:16:39.043+00:00","url":"https://junglewise.ai/threats/cve-2026-50014-pnpm-argument-injection-in-git-fetcher-via-lockfile-commit"},{"cve":"CVE-2026-48995","cvss":4,"epss":0.0017,"slug":"cve-2026-48995-pnpm-missing-integrity-check-for-github-dependencies","title":"pnpm missing integrity check for GitHub dependencies","severity":"medium","exploited":false,"published_at":"2026-06-25T18:16:38.687+00:00","url":"https://junglewise.ai/threats/cve-2026-48995-pnpm-missing-integrity-check-for-github-dependencies"},{"cve":"CVE-2023-37478","cvss":3.1,"epss":0.0121,"slug":"cve-2023-37478-pnpm-tar-archive-parsing-bypass-vulnerability","title":"pnpm tar archive parsing bypass vulnerability","severity":"low","exploited":false,"published_at":"2023-08-01T17:00:55+00:00","url":"https://junglewise.ai/threats/cve-2023-37478-pnpm-tar-archive-parsing-bypass-vulnerability"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Pnpm","slug":"pnpm-pnpm","vendor":{"hub":true,"name":"Pnpm","slug":"pnpm","url":"https://junglewise.ai/threats/vendors/pnpm"},"aliases":[],"category":"package-manager","homepage":"https://pnpm.io","description":"Fast, disk space-efficient Node.js package manager with support for monorepos.","url":"https://junglewise.ai/threats/technologies/pnpm-pnpm"},"most_severe":[{"cve":"CVE-2026-50016","cvss":8.8,"epss":0.0053,"slug":"cve-2026-50016-pnpm-path-traversal-via-transitive-dependency-alias","title":"pnpm path traversal via transitive dependency alias","severity":"high","exploited":false,"published_at":"2026-06-25T18:16:39.303+00:00","url":"https://junglewise.ai/threats/cve-2026-50016-pnpm-path-traversal-via-transitive-dependency-alias"},{"cve":"CVE-2026-55698","cvss":8.8,"epss":0.003,"slug":"cve-2026-55698-pnpm-arbitrary-code-execution-via-malicious-lockfile-metadata","title":"pnpm arbitrary code execution via malicious lockfile metadata","severity":"high","exploited":false,"published_at":"2026-06-25T18:16:40.837+00:00","url":"https://junglewise.ai/threats/cve-2026-55698-pnpm-arbitrary-code-execution-via-malicious-lockfile-metadata"},{"cve":"CVE-2026-59195","cvss":8.2,"epss":0.004,"slug":"cve-2026-59195-pnpm-path-traversal-in-configdependencies-symlink-creation","title":"pnpm path traversal in configDependencies symlink creation","severity":"high","exploited":false,"published_at":"2026-07-06T16:16:37.683+00:00","url":"https://junglewise.ai/threats/cve-2026-59195-pnpm-path-traversal-in-configdependencies-symlink-creation"},{"cve":"CVE-2026-82393","cvss":7.5,"epss":0.0063,"slug":"cve-2026-82393-pnpm-tarball-dependency-manifest-name-path-traversal-arbitrary","title":"pnpm tarball dependency manifest name path traversal arbitrary file write","severity":"high","exploited":false,"published_at":"2026-08-31T22:17:22.353+00:00","url":"https://junglewise.ai/threats/cve-2026-82393-pnpm-tarball-dependency-manifest-name-path-traversal-arbitrary"},{"cve":"CVE-2026-55697","cvss":7.5,"epss":0.0019,"slug":"cve-2026-55697-pnpm-os-command-injection-via-repository-controlled","title":"pnpm OS command injection via repository-controlled configDependencies","severity":"high","exploited":false,"published_at":"2026-06-25T18:16:40.707+00:00","url":"https://junglewise.ai/threats/cve-2026-55697-pnpm-os-command-injection-via-repository-controlled"},{"cve":"CVE-2026-55487","cvss":7.5,"epss":0.0018,"slug":"cve-2026-55487-pnpm-build-policy-bypass-via-opaque-locator-normalization","title":"pnpm build policy bypass via opaque locator normalization spoofing","severity":"high","exploited":false,"published_at":"2026-06-25T18:16:40.46+00:00","url":"https://junglewise.ai/threats/cve-2026-55487-pnpm-build-policy-bypass-via-opaque-locator-normalization"},{"cve":"CVE-2026-101043","cvss":7.4,"slug":"cve-2026-101043-pnpm-versions-11-0-0-before-11-11-0-and-10-7-0-before-10-34-5","title":"pnpm environment variable exfiltration via proxy settings","severity":"high","exploited":false,"published_at":"2026-09-27T18:16:29.7+00:00","url":"https://junglewise.ai/threats/cve-2026-101043-pnpm-versions-11-0-0-before-11-11-0-and-10-7-0-before-10-34-5"},{"cve":"CVE-2026-50015","cvss":7.3,"epss":0.0043,"slug":"cve-2026-50015-pnpm-path-traversal-in-patch-application-pipeline","title":"pnpm path traversal in patch application pipeline","severity":"high","exploited":false,"published_at":"2026-06-25T18:16:39.167+00:00","url":"https://junglewise.ai/threats/cve-2026-50015-pnpm-path-traversal-in-patch-application-pipeline"},{"cve":"CVE-2026-82392","cvss":7.1,"epss":0.0062,"slug":"cve-2026-82392-pnpm-virtual-store-linker-path-traversal-via-unvalidated-deppath","title":"pnpm virtual store linker path traversal via unvalidated depPath","severity":"high","exploited":false,"published_at":"2026-08-31T21:17:54.033+00:00","url":"https://junglewise.ai/threats/cve-2026-82392-pnpm-virtual-store-linker-path-traversal-via-unvalidated-deppath"},{"cve":"CVE-2026-59196","cvss":7.1,"epss":0.004,"slug":"cve-2026-59196-pnpm-path-traversal-via-crafted-lockfile-alias","title":"pnpm path traversal via crafted lockfile alias","severity":"high","exploited":false,"published_at":"2026-07-06T16:16:37.81+00:00","url":"https://junglewise.ai/threats/cve-2026-59196-pnpm-path-traversal-via-crafted-lockfile-alias"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}