pnpm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-69264Highpnpm: pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"CVE-2025-69263Highpnpm: pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies CVE-2025-69262Highpnpm: pnpm vulnerable to Command Injection via environment variable substitution CVE-2024-47829Mediumpnpm: pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting CVE-2024-53866Mediumpnpm: pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion CVE-2023-37478Highpnpm: pnpm incorrectly parses tar archives relative to specification CVE-2022-26183Highpnpm: Untrusted Search Path in PNPM

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo