CVE-2026-50573

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, `pnpm install` in non-frozen mode can accept new remote package content after detecting that the downloaded tarball does not match the integrity recorded in pnpm-lock.yaml. When a package is already locked with an integrity value, and the registry later serves different metadata and tarball content for the same package name and version, pnpm initially reports an integrity mismatch. However, plain pnpm install then performs a resolution repair, accepts the registry's new integrity, updates the lockfile, installs the new content, and exits successfully. This means the lockfile integrity check does not act as a hard stop by default. This vulnerability is fixed in 10.34.0 and 11.4.0.

• CWE-345

• https://github.com/pnpm/pnpm/security/advisories/GHSA-54hh-g5mx-jqcpExploit, Vendor Advisory
• https://github.com/pnpm/pnpm/security/advisories/GHSA-54hh-g5mx-jqcpExploit, Vendor Advisory

Published

Jun 25, 2026

Last Modified

Jun 29, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50567Fission is an open-source, Kubernetes-native serverless fram…7.7
• CVE-2026-50568Fission is an open-source, Kubernetes-native serverless fram…3.6
• CVE-2026-50569Fission is an open-source, Kubernetes-native serverless fram…4.3
• CVE-2026-5057ATEN Unizon RpcProvider Missing Authentication Denial-of-Ser…7.5
• CVE-2026-50570Fission is an open-source, Kubernetes-native serverless fram…8.5
• CVE-2026-50572Envoy is an open source edge and service proxy designed for …5.9
• CVE-2026-50574yt-dlp is a command-line audio/video downloader. Prior to 20…9.6
• CVE-2026-50575BetterDesk is a remote desktop management solution. BetterDe…7.7
• CVE-2026-50576ePA 3.x Integration implements the authorization workflow an…6.8
• CVE-2026-50577ePA 3.x Integration implements the authorization workflow an…7.4
• CVE-2026-50578ePA 3.x Integration implements the authorization workflow an…7.5
• CVE-2026-5058aws-mcp-server Command Injection Remote Code Execution Vulne…9.8