Vulnerability-Lookup

BREW-PNPM-CVE-2026-48995 (GHSA-HG3W-7F8C-63HP)

Vulnerability from osv_homebrew – Published: 2026-08-13 17:28 – Updated: 2026-09-30 20:33 – Source website

Summary

pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

Details

pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. The lockfile does not store the hash of the dependencies from https://codeload.github.com. This means that if this server was compromised or a person's machine configuration was compromised, pnpm would download and install these dependencies. This vulnerability is fixed in 10.33.4 and 11.0.7.

Severity

4.8 (Medium)


                    
                      CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

URL

Type

	https://github.com/CVEProject/cvelistV5/tree/main…	ADVISORY
	https://github.com/pnpm/pnpm/security/advisories/…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-48995	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "11.0.7"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "pnpm",
        "purl": "pkg:brew/pnpm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "11.21.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "git",
    "upstream_evidence": [
      {
        "ecosystem": "GIT",
        "key": "https://github.com/pnpm/pnpm",
        "name": "https://github.com/pnpm/pnpm",
        "strategy": "git",
        "subject_version": "v12.8.1"
      },
      {
        "ecosystem": "npm",
        "key": "pkg:npm/pnpm@12.8.1",
        "name": "pnpm",
        "strategy": "registry",
        "subject_version": "12.8.1"
      }
    ]
  },
  "details": "pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. The lockfile does not store the hash of the dependencies from https://codeload.github.com. This means that if this server was compromised or a person\u0027s machine configuration was compromised, pnpm would download and install these dependencies. This vulnerability is fixed in 10.33.4 and 11.0.7.",
  "id": "BREW-pnpm-CVE-2026-48995",
  "modified": "2026-09-30T20:33:27Z",
  "published": "2026-08-13T17:28:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48995.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-hg3w-7f8c-63hp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48995"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile",
  "upstream": [
    "GHSA-hg3w-7f8c-63hp",
    "CVE-2026-48995"
  ]
}

CVE-2026-48995 (GCVE-0-2026-48995)

Vulnerability from cvelistv5 – Published: 2026-06-25 16:58 – Updated: 2026-06-26 02:11

Title

pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

Summary

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-26 02:11 UTC

CWE

CWE-353 - Missing Support for Integrity Check

Assigner

GitHub_M mitre root Scorecard

References

1 reference

URL	Tags
https://github.com/pnpm/pnpm/security/advisories/…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
pnpm	pnpm	Affected: < 10.33.4 Affected: >= 11.0.0, < 11.0.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48995",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-26T02:11:29.692324Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T02:11:55.249Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-hg3w-7f8c-63hp"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pnpm",
          "vendor": "pnpm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.33.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 11.0.0, \u003c 11.0.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. The lockfile does not store the hash of the dependencies from https://codeload.github.com. This means that if this server was compromised or a person\u0027s machine configuration was compromised, pnpm would download and install these dependencies. This vulnerability is fixed in 10.33.4 and 11.0.7."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-353",
              "description": "CWE-353: Missing Support for Integrity Check",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T16:58:57.536Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pnpm/pnpm/security/advisories/GHSA-hg3w-7f8c-63hp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-hg3w-7f8c-63hp"
        }
      ],
      "source": {
        "advisory": "GHSA-hg3w-7f8c-63hp",
        "discovery": "UNKNOWN"
      },
      "title": "pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48995",
    "datePublished": "2026-06-25T16:58:57.536Z",
    "dateReserved": "2026-05-26T23:26:07.976Z",
    "dateUpdated": "2026-06-26T02:11:55.249Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-HG3W-7F8C-63HP

Vulnerability from github – Published: 2026-06-26 21:49 – Updated: 2026-06-26 21:49

Summary

pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

Details

Summary

A malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile.

Details

The lockfile does not store the hash of the dependencies from https://codeload.github.com

This means that if this server was compromised or a person's machine configuration was compromised, pnpm would download and install these dependencies.

PoC

> pnpm -v     
10.28.2

Given the following package.json:

{
  "dependencies": {
    "add": "git://github.com/dsherret/npm-git-dep.git#b3eeb9b"
  }
}

This produces a lockfile like so:

lockfileVersion: '9.0'

settings:
  autoInstallPeers: true
  excludeLinksFromLockfile: false

importers:

  .:
    dependencies:
      add:
        specifier: git://github.com/dsherret/npm-git-dep.git#b3eeb9b
        version: https://codeload.github.com/dsherret/npm-git-dep/tar.gz/b3eeb9b

packages:

  add@https://codeload.github.com/dsherret/npm-git-dep/tar.gz/b3eeb9b:
    resolution: {tarball: https://codeload.github.com/dsherret/npm-git-dep/tar.gz/b3eeb9b}
    version: 1.0.0

snapshots:

  add@https://codeload.github.com/dsherret/npm-git-dep/tar.gz/b3eeb9b: {}

Notice that there is no hash. The b3eeb9b is not sufficient because I can configure my machine to resolve a compromised tarball from that url (I tested it out and pnpm just installs it).

Impact

Anyone relying on github git dependencies.

Severity

4.8 (Medium)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "pnpm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.33.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "pnpm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0"
            },
            {
              "fixed": "11.0.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48995"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-353"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-26T21:49:22Z",
    "nvd_published_at": "2026-06-25T18:16:38Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nA malicious `codeload.github.com` server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile.\n\n### Details\n\nThe lockfile does not store the hash of the dependencies from https://codeload.github.com\n\nThis means that if this server was compromised or a person\u0027s machine configuration was compromised, pnpm would download and install these dependencies.\n\n### PoC\n\n```sh\n\u003e pnpm -v     \n10.28.2\n```\n\nGiven the following package.json:\n\n```json\n{\n  \"dependencies\": {\n    \"add\": \"git://github.com/dsherret/npm-git-dep.git#b3eeb9b\"\n  }\n}\n```\n\nThis produces a lockfile like so:\n\n```yaml\nlockfileVersion: \u00279.0\u0027\n\nsettings:\n  autoInstallPeers: true\n  excludeLinksFromLockfile: false\n\nimporters:\n\n  .:\n    dependencies:\n      add:\n        specifier: git://github.com/dsherret/npm-git-dep.git#b3eeb9b\n        version: https://codeload.github.com/dsherret/npm-git-dep/tar.gz/b3eeb9b\n\npackages:\n\n  add@https://codeload.github.com/dsherret/npm-git-dep/tar.gz/b3eeb9b:\n    resolution: {tarball: https://codeload.github.com/dsherret/npm-git-dep/tar.gz/b3eeb9b}\n    version: 1.0.0\n\nsnapshots:\n\n  add@https://codeload.github.com/dsherret/npm-git-dep/tar.gz/b3eeb9b: {}\n```\n\nNotice that there is no hash. The `b3eeb9b` is not sufficient because I can configure my machine to resolve a compromised tarball from that url (I tested it out and pnpm just installs it).\n\n### Impact\n\nAnyone relying on github git dependencies.",
  "id": "GHSA-hg3w-7f8c-63hp",
  "modified": "2026-06-26T21:49:22Z",
  "published": "2026-06-26T21:49:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-hg3w-7f8c-63hp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48995"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pnpm/pnpm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BREW-PNPM-CVE-2026-48995 (GHSA-HG3W-7F8C-63HP)

CVE-2026-48995 (GCVE-0-2026-48995)

GHSA-HG3W-7F8C-63HP

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour