CVE-2026-50573

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50573
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50573.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50573
Aliases
Downstream
Published
2026-06-25T16:50:21Z
Modified
2026-09-06T03:30:22Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
pnpm: Unsafe default behavior breaks integrity check
Details

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm install in non-frozen mode can accept new remote package content after detecting that the downloaded tarball does not match the integrity recorded in pnpm-lock.yaml. When a package is already locked with an integrity value, and the registry later serves different metadata and tarball content for the same package name and version, pnpm initially reports an integrity mismatch. However, plain pnpm install then performs a resolution repair, accepts the registry's new integrity, updates the lockfile, installs the new content, and exits successfully. This means the lockfile integrity check does not act as a hard stop by default. This vulnerability is fixed in 10.34.0 and 11.4.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-345"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50573.json"
}
References

Affected packages

Git / github.com/pnpm/pnpm

Affected ranges

Type
GIT
Repo
https://github.com/pnpm/pnpm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b7d12c98d4b8d6a4da75c70db260b84f96215ac8
Introduced
8aeeff4c46b939707fcb973c444c44809f691ef5
Fixed
44e06cf16b71e9421ba01d5374c8667edf1f21fd
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "10.34.0"
        },
        {
            "introduced": "11.0.0"
        },
        {
            "fixed": "11.4.0"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50573.json"