CVE-2026-48995: pnpm Lockfile Hash Validation Bypass – Supply Chain Risk

Technical summary

The vulnerability stems from insufficient integrity checking in pnpm's dependency resolution process when fetching tarballs from codeload.github.com. While pnpm uses lockfiles to pin dependency versions, the lockfile does not record the hash of content retrieved from GitHub's codeload endpoint. An attacker controlling or intercepting the codeload.github.com server can serve arbitrary tarballs; pnpm will extract and install them regardless of lockfile contents. The flaw affects pnpm versions prior to 10.33.4 and 11.0.7, where the integrity validation has been implemented. This is classified as a missing cryptographic verification issue (CWE-353).

Business impact

For organizations using pnpm, this vulnerability enables supply-chain attacks that could inject malicious code into built applications at install time. An attacker with network access or server control could compromise development environments, CI/CD pipelines, and production deployments without detection by standard lockfile verification. The impact spans confidentiality, integrity, and availability—malicious packages could exfiltrate source code, inject backdoors, or disrupt builds. Any project relying on GitHub-hosted dependencies via pnpm is exposed if the network or server is compromised.

Affected systems

The vulnerability affects pnpm versions prior to 10.33.4 (9.x and early 10.x releases) and prior to 11.0.7 (early 11.x releases). It impacts any development environment, build system, or CI/CD pipeline using these versions to install dependencies. Projects that fetch packages from GitHub via codeload.github.com are most directly at risk, though the scope includes any pnpm-managed project if the network or GitHub infrastructure is compromised.

Exploitability

Exploitation requires either compromise of the codeload.github.com server or a network-level man-in-the-middle attack (e.g., DNS hijacking, BGP hijacking, or local network compromise). The CVSS score of 7.5 reflects high impact but higher complexity—an attacker cannot simply cause exploitation from the network without some prerequisite control. User interaction is required in the sense that a developer must run `pnpm install` or equivalent, but this is routine and expected behavior. Once a malicious tarball is served, installation is automatic and undetected.

Remediation

Update pnpm to version 10.33.4 or later if using the 10.x branch, or 11.0.7 or later if using 11.x. These versions implement cryptographic hash validation for codeload.github.com dependencies, ensuring lockfile integrity is enforced. Verify the update through your package manager (npm, Homebrew, direct download, etc.) and test in a staging environment before production deployment.

Patch guidance

Check your current pnpm version using `pnpm --version`. If you are on 10.x, upgrade to 10.33.4 or later; if on 11.x, upgrade to 11.0.7 or later. Updates can be installed via `npm install -g pnpm@latest` or your system package manager. After upgrading, re-run `pnpm install` in affected projects to ensure lockfiles are validated correctly. No additional configuration changes are required. Verify the patched version is in use across all development machines and CI/CD agents.

Detection guidance

Audit your pnpm version across all development and CI/CD infrastructure using `pnpm --version` or package inventory tools. Check project lockfiles (pnpm-lock.yaml) for any unexplained modifications or unusual dependency entries from codeload.github.com—though lockfile tampering alone does not indicate active exploitation. Monitor network traffic from development and build systems for unexpected connections to codeload.github.com or suspicious HTTP/HTTPS responses. Enable supply-chain security scanning tools that verify package integrity during installation. Review logs for install operations that occurred before the patch was applied.

Why prioritize this

This vulnerability warrants prompt but measured attention. While it enables serious supply-chain attacks, exploitation requires network-level control or server compromise—not trivial for most attackers. However, the high impact (code execution in build environments) and growing sophistication of supply-chain attacks make this a priority for teams managing large JavaScript/Node.js codebases or those in regulated industries. Patch within your standard update cycle, accelerating if your organization already assumes network compromise or high-value supply-chain risk.

Risk score, explained

The CVSS 7.5 HIGH score reflects the combination of high impact (confidentiality, integrity, and availability all affected) and moderate attack complexity. Attack vector is network-based, but the attacker must either compromise a major service (codeload.github.com) or intercept network traffic, hence the AC:H rating. No privileges or authentication are required. User interaction is needed (running pnpm install), but this is routine. The score appropriately captures serious but not critical risk; it is not currently in the Known Exploited Vulnerabilities catalog.

Frequently asked questions