Arbitrary Dependency Installation in pnpm

Compliance Impact

The provided information does not specify how the vulnerability in pnpm affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

The vulnerability CVE-2026-48995 affects the pnpm package manager in versions prior to 10.33.4 and between 11.0.0 to 11.0.6. The issue is that the pnpm lockfile does not store the hash of dependencies downloaded from https://codeload.github.com. Because of this, a malicious or compromised codeload.github.com server can serve any tarball it wants, and pnpm will install it without verifying its integrity against the lockfile.

This means that if the codeload.github.com server is compromised or if a user's machine configuration is compromised, an attacker could cause pnpm to download and install malicious code, potentially leading to arbitrary code execution.

The vulnerability has been fixed in pnpm versions 10.33.4 and 11.0.7.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to execute arbitrary code on your machine if they can manipulate the codeload.github.com server or your machine's configuration.

Because pnpm installs dependencies without verifying their integrity from the compromised server, malicious code could be introduced into your environment during package installation.

This could lead to unauthorized actions, data compromise, or further system compromise depending on the nature of the malicious code.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the pnpm package manager to a patched version.

• Upgrade pnpm to version 10.33.4 or later.
• Alternatively, upgrade to version 11.0.7 or later.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects pnpm versions below 10.33.4 and between 11.0.0 to 11.0.6, where the lockfile does not verify the hash of dependencies downloaded from codeload.github.com. Detection involves identifying if your system is running an affected pnpm version and monitoring network traffic for downloads from codeload.github.com.

• Check the installed pnpm version with the command: pnpm --version
• Inspect your pnpm lockfile to verify if it includes hashes for GitHub git dependencies (note: prior to the fix, it does not).
• Monitor network traffic or logs for connections to codeload.github.com to detect unexpected or suspicious tarball downloads.
• Use network monitoring tools (e.g., tcpdump or Wireshark) to capture and analyze traffic to codeload.github.com.

Useful 0 Not Useful 0