CVE-2026-101044

pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...

CVE-2026-101043

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...

CVE-2026-101044

A flaw was found in pnpm. The package manager does not properly sanitize dependency names and alias paths specified within project lockfiles. By convincing a user or build system to install a project containing a crafted lockfile, an attacker can exploit this path traversal issue to create...

CVE-2026-101043

A flaw was found in pnpm. This vulnerability can lead to information disclosure because proxy settings defined in workspace configuration files expand environment variable placeholders without proper restrictions. An attacker who convinces a user or automated system to run a command within a...

EUVD-2026-87975

pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...

CVE-2026-101043

The pnpm package manager (versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 ) is vulnerable to environment variable exfiltration. The root cause is that pnpm-workspace.yaml files expand ${VAR} placeholders in httpProxy, httpsProxy, and noProxy settings without sufficient restrictions. An a...

CVE-2026-101044 pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias

pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...

CVE-2026-101043 pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...

EUVD-2026-87974

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...

CVE-2026-101044

The pacquet Rust package-manager component, included in pnpm versions >=12.0.0-alpha.0 and

CVE-2026-101043 pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...

CVE-2026-101044 pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias

pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...

CVE-2026-101044: Improper Limitation of a Pathname to a Restricted Directory

pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...

CVE-2026-101043: Insertion of Sensitive Information Into Sent Data

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...

CVE-2023-37478_npm_vs_pnpm

pnpm vs npm exploit This repo showcases how a difference in npm and pnpminstallation from tarballs can be exploited. The exploit is recorded in CVE-2023-37478. The javascript package constructed here claims it prints out a nice message to the user. When installed with npm, this is true. However,...

functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import

MCP setfunctypeversion Package Alias RCE via Unsanitized pnpm install + Dynamic Import Summary The setfunctypeversion MCP tool in functype-mcp-server accepts an unconstrained version string, interpolates it directly into an npm package specifier functype@, and installs it via pnpm add without any...

GHSA-WCJJ-9M6G-2FR2 functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import

MCP setfunctypeversion Package Alias RCE via Unsanitized pnpm install + Dynamic Import Summary The setfunctypeversion MCP tool in functype-mcp-server accepts an unconstrained version string, interpolates it directly into an npm package specifier functype@, and installs it via pnpm add without any...

@forgeax/game (>=0.3.0, <=0.3.4), @huiliyi37/cordis-plugin-loader (>=0.2.0, <=0.8.0) +7 more potentially affected by CVE-2026-82392 via pnpm (>=11.5.3, <=11.7.0)

pnpm NPM version =11.5.3, =0.3.0, =0.2.0, =0.2.4, =0.1.2, =0.1.13, =2.2.0, =2.2.12 Source cves: CVE-2026-82392 Source advisory: OSV:GHSA-C59Q-G84Q-2GJ5...

EUVD-2026-68816

pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph...

NPM: pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

NPM: pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph vulnerability discovered by ? in WordPress Npm pnpm versions 10.34.5...