Bug 2493039 (CVE-2026-50021) - CVE-2026-50021 pnpm: pnpm: Integrity bypass allows installation of altered packages via modified lockfile
Summary: CVE-2026-50021 pnpm: pnpm: Integrity bypass allows installation of altered pa...
Keywords:
Status: NEW
Alias: CVE-2026-50021
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-25 18:02 UTC by OSIDB Bzimport
Modified: 2026-07-06 13:01 UTC (History)
32 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-06-25 18:02:59 UTC 
pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's tarball extraction worker skips integrity verification when the integrity field is absent from the lockfile resolution. If an attacker can both modify pnpm-lock.yaml to remove the integrity: field and cause the referenced registry URL to serve altered package content, pnpm install --frozen-lockfile can install the altered package without an integrity error. npm's npm ci enforces integrity by default; pnpm's behavior of silently skipping verification is a pnpm-specific fail-open gap. This vulnerability is fixed in 10.34.0 and 11.4.0.
Note You need to log in before you can comment on or make changes to this bug.