{"schema_version":1,"title":"pnpm (npm) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 14 vulnerabilities in pnpm (npm): 0 in the last 7 days and 2 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, pnpm pacquet path traversal in lockfile dependency symlinks, was published on 1 September 2026.","url":"https://junglewise.ai/threats/technologies/pnpm","json_url":"https://junglewise.ai/threats/technologies/pnpm.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/pnpm","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":5,"all_time":14,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":2,"last_90_days":2,"last_365_days":11},"latest":[{"cvss":3.1,"slug":"pnpm-pacquet-path-traversal-in-lockfile-dependency-symlinks-dc3f81d1","title":"pnpm pacquet path traversal in lockfile dependency symlinks","severity":"low","exploited":false,"published_at":"2026-09-01T18:59:22+00:00","url":"https://junglewise.ai/threats/pnpm-pacquet-path-traversal-in-lockfile-dependency-symlinks-dc3f81d1"},{"cvss":7.1,"slug":"pnpm-pacquet-path-traversal-in-lockfile-install-2f692861","title":"pnpm pacquet path traversal in lockfile install","severity":"high","exploited":false,"published_at":"2026-09-01T18:59:22+00:00","url":"https://junglewise.ai/threats/pnpm-pacquet-path-traversal-in-lockfile-install-2f692861"},{"cve":"CVE-2026-55700","cvss":7.1,"epss":0.0042,"slug":"cve-2026-55700-pnpm-path-traversal-in-stage-download-command","title":"pnpm path traversal in stage download command","severity":"high","exploited":false,"published_at":"2026-06-25T18:16:41.087+00:00","url":"https://junglewise.ai/threats/cve-2026-55700-pnpm-path-traversal-in-stage-download-command"},{"cve":"CVE-2026-24131","cvss":4,"epss":0.0028,"slug":"cve-2026-24131-pnpm-path-traversal-via-directories-bin","title":"pnpm path traversal via directories.bin","severity":"medium","exploited":false,"published_at":"2026-01-26T21:29:58+00:00","url":"https://junglewise.ai/threats/cve-2026-24131-pnpm-path-traversal-via-directories-bin"},{"cve":"CVE-2026-23888","cvss":3.1,"epss":0.0046,"slug":"cve-2026-23888-pnpm-path-traversal-in-binary-extraction-zip-slip","title":"pnpm path traversal in binary extraction (Zip Slip)","severity":"low","exploited":false,"published_at":"2026-01-26T21:02:49+00:00","url":"https://junglewise.ai/threats/cve-2026-23888-pnpm-path-traversal-in-binary-extraction-zip-slip"},{"cve":"CVE-2026-23889","cvss":3.1,"epss":0.0049,"slug":"cve-2026-23889-pnpm-windows-specific-tarball-path-traversal","title":"pnpm Windows-specific tarball path traversal","severity":"low","exploited":false,"published_at":"2026-01-26T21:02:44+00:00","url":"https://junglewise.ai/threats/cve-2026-23889-pnpm-windows-specific-tarball-path-traversal"},{"cve":"CVE-2026-23890","cvss":3.1,"epss":0.0051,"slug":"cve-2026-23890-pnpm-scoped-bin-name-path-traversal","title":"pnpm scoped bin name path traversal","severity":"low","exploited":false,"published_at":"2026-01-26T21:02:39+00:00","url":"https://junglewise.ai/threats/cve-2026-23890-pnpm-scoped-bin-name-path-traversal"},{"cve":"CVE-2026-24056","cvss":3.1,"epss":0.0054,"slug":"cve-2026-24056-pnpm-symlink-traversal-in-file-and-git-dependencies","title":"pnpm symlink traversal in file and git dependencies","severity":"low","exploited":false,"published_at":"2026-01-26T21:02:33+00:00","url":"https://junglewise.ai/threats/cve-2026-24056-pnpm-symlink-traversal-in-file-and-git-dependencies"},{"cve":"CVE-2025-69262","cvss":7.5,"epss":0.0106,"slug":"cve-2025-69262-pnpm-command-injection-via-environment-variable-substitution-in","title":"pnpm command injection via environment variable substitution in tokenHelper","severity":"high","exploited":false,"published_at":"2026-01-07T23:15:50.33+00:00","url":"https://junglewise.ai/threats/cve-2025-69262-pnpm-command-injection-via-environment-variable-substitution-in"},{"cve":"CVE-2025-69264","cvss":8.8,"epss":0.0103,"slug":"cve-2025-69264-pnpm-arbitrary-code-execution-via-git-dependency-script-bypass","title":"pnpm arbitrary code execution via Git dependency script bypass","severity":"high","exploited":false,"published_at":"2026-01-07T22:15:43.89+00:00","url":"https://junglewise.ai/threats/cve-2025-69264-pnpm-arbitrary-code-execution-via-git-dependency-script-bypass"},{"cve":"CVE-2025-69263","cvss":7.5,"epss":0.0048,"slug":"cve-2025-69263-pnpm-lockfile-integrity-bypass-in-http-and-git-dependencies","title":"pnpm lockfile integrity bypass in HTTP and Git dependencies","severity":"high","exploited":false,"published_at":"2026-01-07T22:15:43.727+00:00","url":"https://junglewise.ai/threats/cve-2025-69263-pnpm-lockfile-integrity-bypass-in-http-and-git-dependencies"},{"cve":"CVE-2024-47829","cvss":3.1,"epss":0.0023,"slug":"cve-2024-47829-pnpm-md5-path-collision-causing-package-replacement","title":"pnpm MD5 path collision causing package replacement","severity":"low","exploited":false,"published_at":"2025-04-23T14:05:47+00:00","url":"https://junglewise.ai/threats/cve-2024-47829-pnpm-md5-path-collision-causing-package-replacement"},{"cve":"CVE-2024-53866","cvss":4,"epss":0.0098,"slug":"cve-2024-53866-pnpm-global-cache-poisoning-via-overrides-and-ignore-scripts","title":"pnpm global cache poisoning via overrides and ignore-scripts evasion","severity":"medium","exploited":false,"published_at":"2024-12-10T22:42:41+00:00","url":"https://junglewise.ai/threats/cve-2024-53866-pnpm-global-cache-poisoning-via-overrides-and-ignore-scripts"},{"cve":"CVE-2022-26183","cvss":3.1,"epss":0.0159,"slug":"cve-2022-26183-pnpm-untrusted-search-path-binary-planting-on-windows","title":"pnpm untrusted search path binary planting on Windows","severity":"low","exploited":false,"published_at":"2022-03-23T00:00:24+00:00","url":"https://junglewise.ai/threats/cve-2022-26183-pnpm-untrusted-search-path-binary-planting-on-windows"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"flowise (npm)","slug":"flowise","vulnerabilities":156,"url":"https://junglewise.ai/threats/technologies/flowise"},{"name":"vm2 (npm)","slug":"vm2","vulnerabilities":82,"url":"https://junglewise.ai/threats/technologies/vm2"},{"name":"@budibase/server (npm)","slug":"budibase-server","vulnerabilities":61,"url":"https://junglewise.ai/threats/technologies/budibase-server"},{"name":"directus (npm)","slug":"directus","vulnerabilities":60,"url":"https://junglewise.ai/threats/technologies/directus"},{"name":"nocodb (npm)","slug":"nocodb","vulnerabilities":55,"url":"https://junglewise.ai/threats/technologies/nocodb"},{"name":"hono (npm)","slug":"hono","vulnerabilities":54,"url":"https://junglewise.ai/threats/technologies/hono"},{"name":"parse-server (npm)","slug":"parse-server","vulnerabilities":42,"url":"https://junglewise.ai/threats/technologies/parse-server"},{"name":"dompurify (npm)","slug":"dompurify","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/dompurify"},{"name":"ghost (npm)","slug":"ghost","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/ghost"},{"name":"flowise-components (npm)","slug":"flowise-components","vulnerabilities":35,"url":"https://junglewise.ai/threats/technologies/flowise-components"},{"name":"astro (npm)","slug":"astro","vulnerabilities":30,"url":"https://junglewise.ai/threats/technologies/astro"},{"name":"@anthropic-ai/claude-code (npm)","slug":"anthropic-ai-claude-code","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/anthropic-ai-claude-code"}],"technology":{"hub":true,"name":"pnpm (npm)","slug":"pnpm","vendor":{"name":"npm","slug":"npm","url":"https://junglewise.ai/threats/vendors/npm"},"aliases":[],"homepage":"https://pnpm.io/","repo_url":"https://github.com/pnpm/pnpm","description":"A fast, disk space efficient package manager for Node.js.","url":"https://junglewise.ai/threats/technologies/pnpm"},"most_severe":[{"cve":"CVE-2025-69264","cvss":8.8,"epss":0.0103,"slug":"cve-2025-69264-pnpm-arbitrary-code-execution-via-git-dependency-script-bypass","title":"pnpm arbitrary code execution via Git dependency script bypass","severity":"high","exploited":false,"published_at":"2026-01-07T22:15:43.89+00:00","url":"https://junglewise.ai/threats/cve-2025-69264-pnpm-arbitrary-code-execution-via-git-dependency-script-bypass"},{"cve":"CVE-2025-69262","cvss":7.5,"epss":0.0106,"slug":"cve-2025-69262-pnpm-command-injection-via-environment-variable-substitution-in","title":"pnpm command injection via environment variable substitution in tokenHelper","severity":"high","exploited":false,"published_at":"2026-01-07T23:15:50.33+00:00","url":"https://junglewise.ai/threats/cve-2025-69262-pnpm-command-injection-via-environment-variable-substitution-in"},{"cve":"CVE-2025-69263","cvss":7.5,"epss":0.0048,"slug":"cve-2025-69263-pnpm-lockfile-integrity-bypass-in-http-and-git-dependencies","title":"pnpm lockfile integrity bypass in HTTP and Git dependencies","severity":"high","exploited":false,"published_at":"2026-01-07T22:15:43.727+00:00","url":"https://junglewise.ai/threats/cve-2025-69263-pnpm-lockfile-integrity-bypass-in-http-and-git-dependencies"},{"cve":"CVE-2026-55700","cvss":7.1,"epss":0.0042,"slug":"cve-2026-55700-pnpm-path-traversal-in-stage-download-command","title":"pnpm path traversal in stage download command","severity":"high","exploited":false,"published_at":"2026-06-25T18:16:41.087+00:00","url":"https://junglewise.ai/threats/cve-2026-55700-pnpm-path-traversal-in-stage-download-command"},{"cvss":7.1,"slug":"pnpm-pacquet-path-traversal-in-lockfile-install-2f692861","title":"pnpm pacquet path traversal in lockfile install","severity":"high","exploited":false,"published_at":"2026-09-01T18:59:22+00:00","url":"https://junglewise.ai/threats/pnpm-pacquet-path-traversal-in-lockfile-install-2f692861"},{"cve":"CVE-2024-53866","cvss":4,"epss":0.0098,"slug":"cve-2024-53866-pnpm-global-cache-poisoning-via-overrides-and-ignore-scripts","title":"pnpm global cache poisoning via overrides and ignore-scripts evasion","severity":"medium","exploited":false,"published_at":"2024-12-10T22:42:41+00:00","url":"https://junglewise.ai/threats/cve-2024-53866-pnpm-global-cache-poisoning-via-overrides-and-ignore-scripts"},{"cve":"CVE-2026-24131","cvss":4,"epss":0.0028,"slug":"cve-2026-24131-pnpm-path-traversal-via-directories-bin","title":"pnpm path traversal via directories.bin","severity":"medium","exploited":false,"published_at":"2026-01-26T21:29:58+00:00","url":"https://junglewise.ai/threats/cve-2026-24131-pnpm-path-traversal-via-directories-bin"},{"cve":"CVE-2022-26183","cvss":3.1,"epss":0.0159,"slug":"cve-2022-26183-pnpm-untrusted-search-path-binary-planting-on-windows","title":"pnpm untrusted search path binary planting on Windows","severity":"low","exploited":false,"published_at":"2022-03-23T00:00:24+00:00","url":"https://junglewise.ai/threats/cve-2022-26183-pnpm-untrusted-search-path-binary-planting-on-windows"},{"cve":"CVE-2026-24056","cvss":3.1,"epss":0.0054,"slug":"cve-2026-24056-pnpm-symlink-traversal-in-file-and-git-dependencies","title":"pnpm symlink traversal in file and git dependencies","severity":"low","exploited":false,"published_at":"2026-01-26T21:02:33+00:00","url":"https://junglewise.ai/threats/cve-2026-24056-pnpm-symlink-traversal-in-file-and-git-dependencies"},{"cve":"CVE-2026-23890","cvss":3.1,"epss":0.0051,"slug":"cve-2026-23890-pnpm-scoped-bin-name-path-traversal","title":"pnpm scoped bin name path traversal","severity":"low","exploited":false,"published_at":"2026-01-26T21:02:39+00:00","url":"https://junglewise.ai/threats/cve-2026-23890-pnpm-scoped-bin-name-path-traversal"}],"generated_at":"2026-09-26T10:14:00.201383+00:00"}