CVE-2026-50021

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's tarball extraction worker skips integrity verification when the integrity field is absent from the lockfile resolution. If an attacker can both modify pnpm-lock.yaml to remove the integrity: field and cause the referenced registry URL to serve altered package content, pnpm install --frozen-lockfile can install the altered package without an integrity error. npm's npm ci enforces integrity by default; pnpm's behavior of silently skipping verification is a pnpm-specific fail-open gap. This vulnerability is fixed in 10.34.0 and 11.4.0.

• CWE-354

• https://github.com/pnpm/pnpm/security/advisories/GHSA-q6j5-fjx5-2mc3Exploit, Mitigation, Vendor Advisory
• https://github.com/pnpm/pnpm/security/advisories/GHSA-q6j5-fjx5-2mc3Exploit, Mitigation, Vendor Advisory

Published

Jun 25, 2026

Last Modified

Jun 29, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50015pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm…7.3
• CVE-2026-50016pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm…8.8
• CVE-2026-50017pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm…6.5
• CVE-2026-50019yt-dlp is a command-line audio/video downloader. From 2023.0…7.4
• CVE-2026-5002A vulnerability has been found in PromtEngineer localGPT up …7.3
• CVE-2026-50020Netty is a network application framework for development of …5.3
• CVE-2026-50023yt-dlp is a command-line audio/video downloader. Prior to 20…9.6
• CVE-2026-50026Frappe is a full-stack web application framework. Prior to v…6.9
• CVE-2026-5003A vulnerability was found in PromtEngineer localGPT up to 4d…5.5
• CVE-2026-50030DataEase is an open source data visualization and analysis t…7.1
• CVE-2026-50031ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer ov…7.5
• CVE-2026-50032A NULL pointer dereference in the MMS Write Named Variable L…8.7