CVE-2026-50021

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Published

Jun 25, 2026, 4:48:27 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.18% · Oct 25, 2026

A flaw was found in pnpm, a package manager. An attacker who can modify the `pnpm-lock.yaml` file and control the package registry can exploit this vulnerability. By removing the integrity field from the lockfile and serving altered package content, the `pnpm install --frozen-lockfile` command can install malicious or altered software without integrity verification. This can lead to the execution of arbitrary code or other malicious activities on the system. pnpm: pnpm: Integrity bypass allows installation of altered packages via modified lockfile This is an Important supply chain vulnerability in pnpm that allows an attacker to bypass package integrity verification. By manipulating the `pnpm-lock.yaml` file to remove integrity checks and controlling the package registry, an attacker can cause `pnpm install --frozen-lockfile` to install malicious or altered packages without detection. This poses a significant risk in environments where both lockfile modification and registry control are possible, leading to potential arbitrary code execution. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.