Command Injection Risk in pnpm Package Manager by pnpm

CVE-2026-50014

What is CVE-2026-50014?

The pnpm package manager allows command injection through its handling of lockfile-controlled Git resolutions. In versions prior to 10.34.0 and 11.4.0, a malicious actor could manipulate the lockfile to replace the intended 40-character commit hash with a Git option such as --upload-pack=. This could lead to unauthorized command execution when fetching dependencies via SSH or local transports, increasing the risk of malicious code execution within the project. Users are advised to upgrade to the patched versions to mitigate this significant security risk.

References