CVE-2026-50573

[CVE catalog]

Severity

Medium · CVSS 6.8CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Published

Jun 25, 2026, 4:50:21 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.17% · Oct 27, 2026

A flaw was found in pnpm, a package manager. This vulnerability allows a remote attacker to bypass package integrity checks during the `pnpm install` process when operating in non-frozen mode. If a malicious package registry serves altered content for a locked package, pnpm may accept this new content and update its lockfile. This could lead to the installation of unintended or malicious software, compromising the integrity and confidentiality of the system. pnpm: pnpm: Package integrity check bypass allows installation of malicious content Moderate: This flaw in pnpm allows a compromised package registry to serve altered content for locked packages, bypassing integrity checks during `pnpm install` operations when not in frozen mode. This could lead to the installation of malicious or unintended software, impacting the integrity and confidentiality of development or build environments where `pnpm install` is used without the `--frozen-lockfile` option. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.