A vulnerability in the pnpm package manager allows remote attackers to execute arbitrary code by serving malicious content to victims during dependency installation.

This is a download of code without an integrity check (CWE-494) occurring within the pnpm lockfile management process. An unauthenticated attacker can exploit this by publishing a package containing an HTTP or git-hosted tarball, which triggers the installation of malicious code on the victim's system or CI/CD environment.

The lack of integrity verification for dependencies presents a severe risk to the software supply chain. Successful exploitation allows for arbitrary code execution, which can lead to full system compromise, the theft of sensitive credentials or intellectual property, and the poisoning of build pipelines. Given the CVSS score of 7.5, this vulnerability is considered a high-severity risk to organizational security and infrastructure integrity.

Immediate Action: Update pnpm to version 10.26.0 or later immediately to enable mandatory integrity checks for all dependencies.

Proactive Monitoring: Monitor CI/CD logs for unexpected network activity during dependency installation phases and audit lockfiles for suspicious remote tarball sources.

Compensating Controls: Implement strict network egress filtering on build servers to prevent unauthorized connections to unknown external repositories.

Public Exploit Available: Unknown

The reliance on lockfiles for security makes this vulnerability particularly insidious, as it subverts the trust model used by developers to ensure build reproducibility. Organizations must prioritize upgrading their pnpm installation to version 10.26.0 immediately to prevent potential supply chain attacks. Failure to patch will leave development environments and CI/CD pipelines vulnerable to malicious code injection.