CVE-2026-50014

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.0 pnpm versions prior to 11.4.0

Description pnpm passes the git resolution.commit value from the lockfile to the git fetch command without using a -- separator or performing commit-format validation. When git dependencies are fetched via the shallow-fetch path, a malicious lockfile can replace the 40-character commit hash with a Git option, such as --upload-pack=<command>. For local transports and SSH, the --upload-pack option can execute the specified command. HTTPS transports are not affected as they ignore this option.

Recommendations Update pnpm to version 10.34.0 or later. Update pnpm to version 11.4.0 or later.