CVE-2026-50021

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50021
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50021.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50021
Aliases
Downstream
Published
2026-06-25T16:48:27Z
Modified
2026-09-06T03:46:03Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field
Details

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's tarball extraction worker skips integrity verification when the integrity field is absent from the lockfile resolution. If an attacker can both modify pnpm-lock.yaml to remove the integrity: field and cause the referenced registry URL to serve altered package content, pnpm install --frozen-lockfile can install the altered package without an integrity error. npm's npm ci enforces integrity by default; pnpm's behavior of silently skipping verification is a pnpm-specific fail-open gap. This vulnerability is fixed in 10.34.0 and 11.4.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-354"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50021.json"
}
References

Affected packages

Git / github.com/pnpm/pnpm

Affected ranges

Type
GIT
Repo
https://github.com/pnpm/pnpm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b7d12c98d4b8d6a4da75c70db260b84f96215ac8
Introduced
8aeeff4c46b939707fcb973c444c44809f691ef5
Fixed
44e06cf16b71e9421ba01d5374c8667edf1f21fd
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "10.34.0"
        },
        {
            "introduced": "11.0.0"
        },
        {
            "fixed": "11.4.0"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50021.json"