cvedb.io
CVE-2026-48995
HIGH · CVSS 7.5
EPSS exploitation probability: 0%
Published 2026-06-25T18:16:38.687 · Last modified 2026-06-29T20:30:18.520

Summary

pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. The lockfile does not store the hash of the dependencies from https://codeload.github.com. This means that if this server was compromised or a person's machine configuration was compromised, pnpm would download and install these dependencies. This vulnerability is fixed in 10.33.4 and 11.0.7.

Affected products

pnpm — pnpm

Does this affect you?

Add your gear to cvedb and we'll alert you only when pnpm ships something exploited.

Check my exposure →

References

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.