CVE-2026-48995

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Published

Jun 25, 2026, 4:58:57 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.17% · Oct 27, 2026

A flaw was found in pnpm, a package manager. This vulnerability allows a remote attacker to serve malicious software packages if the `codeload.github.com` server is compromised or a user's machine configuration is tampered with. The issue arises because pnpm does not verify the integrity of dependencies downloaded from `https://codeload.github.com` against its lockfile. This could lead to the installation of unverified and potentially malicious code, resulting in arbitrary code execution on the affected system. pnpm: pnpm: Supply chain compromise from unverified dependencies This Important vulnerability in pnpm, as shipped in Red Hat products, exposes users to supply chain attacks by failing to verify the integrity of dependencies sourced from `codeload.github.com`. If the `codeload.github.com` server is compromised or a user's local machine configuration is tampered with, pnpm could install malicious software packages without detection, leading to arbitrary code execution. This risk is heightened in environments where developers rely on GitHub git dependencies without additional integrity checks. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.