CVE-2026-50021

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's tarball extraction worker skips integrity verification when the integrity field is absent from the lockfile resolution. If an attacker can both modify pnpm-lock.yaml to remove the integrity: field and cause the referenced registry URL to serve altered package content, pnpm install --frozen-lockfile can install the altered package without an integrity error. npm's npm ci enforces integrity by default; pnpm's behavior of silently skipping verification is a pnpm-specific fail-open gap. This vulnerability is fixed in 10.34.0 and 11.4.0.

• CWE-354

• https://github.com/pnpm/pnpm/security/advisories/GHSA-q6j5-fjx5-2mc3Exploit, Mitigation, Vendor Advisory
• https://github.com/pnpm/pnpm/security/advisories/GHSA-q6j5-fjx5-2mc3Exploit, Mitigation, Vendor Advisory

Published

Jun 25, 2026

Last Modified

Jun 29, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50016pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm…8.8
• CVE-2026-50017pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm…6.5
• CVE-2026-50018Hoverfly is an open source API simulation tool. Prior to ver…6.5
• CVE-2026-50019yt-dlp is a command-line audio/video downloader. From 2023.0…7.4
• CVE-2026-5002A vulnerability has been found in PromtEngineer localGPT up …7.3
• CVE-2026-50020Netty is a network application framework for development of …5.3
• CVE-2026-50022Metacat is data repository software that helps researchers p…5.8
• CVE-2026-50023yt-dlp is a command-line audio/video downloader. Prior to 20…9.6
• CVE-2026-50024GitHacker is a tool that restores Git repositories from expo…5.3
• CVE-2026-50025Mousehole is a background service to update a seedbox IP for…6.9
• CVE-2026-50026Frappe is a full-stack web application framework. Prior to v…6.9
• CVE-2026-50027mcp-memory-service is a semantic memory layer for AI applica…9.8