CVE-2026-50014: pnpm Git Dependency Command Injection – Patch Guide

Technical summary

pnpm's shallow-fetch code path for git dependencies concatenates the lockfile-provided commit value directly into a git fetch command without argument separation or validation. The vulnerability stems from missing `--` argument termination before the commit reference, allowing options like `--upload-pack=<malicious_command>` to be injected. When git uses SSH or local transports, the `--upload-pack` option specifies an alternative upload program, enabling command execution. The HTTPS transport explicitly rejects this option, limiting practical impact to SSH and local git URLs. The vulnerability is classified as CWE-88 (Argument Injection). Fixed versions are 10.34.0 and 11.4.0.

Business impact

This vulnerability primarily affects organizations and developers using pnpm for managing dependencies from private or internal git repositories over SSH. The attack requires lockfile compromise, suggesting targeted supply-chain attacks or insider threats rather than mass exploitation. Impact includes arbitrary code execution on developer machines and CI/CD systems during `pnpm install`. For teams exclusively using public registries or HTTPS git sources, risk is significantly lower. Organizations should prioritize patching if they rely on SSH-based private git dependencies, as compromise of a single lockfile could affect all downstream consumers of that project.

Affected systems

pnpm versions prior to 10.34.0 and 11.4.0 are affected. This includes all 9.x versions and 10.0–10.33.x versions, as well as 11.0–11.3.x. Projects using pnpm as their package manager, particularly those consuming git dependencies via SSH or local file paths, face risk. Development environments, CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins, etc.), and build containers running affected pnpm versions are vulnerable during dependency installation steps.

Exploitability

Exploitation requires two preconditions: (1) an attacker must be able to modify or inject a malicious lockfile into the project repository, and (2) a user or automation must run `pnpm install` or equivalent commands that resolve git dependencies. This is not remotely exploitable in the traditional sense—the attack vector is supply-chain poisoning. However, for projects using SSH git dependencies, the barrier to code execution is low once the lockfile is compromised. No user interaction beyond running a standard install command is needed. The CVSS score of 6.4 (MEDIUM) reflects moderate attack complexity and the requirement for lockfile control, but does not diminish the severity of arbitrary code execution when conditions are met.

Remediation

Upgrade pnpm to version 10.34.0 or later (for 10.x) or 11.4.0 or later (for 11.x). Users on version 9.x should also upgrade to a supported stable branch. After patching, ensure all developers, CI/CD agents, and container images using pnpm are updated. Verify the fix is applied by running `pnpm --version`. Consider supplementary controls: enable lockfile integrity checks via git commit signing, restrict lockfile write permissions, use SSH key passphrases and monitoring, and audit recent lockfile changes for suspicious commit references. For high-assurance environments, validate that commit hashes in lockfiles are legitimate 40-character SHA-1 references before executing installs.

Patch guidance

Update pnpm to version 10.34.0 or 11.4.0 depending on your current branch. For npm users, run `npm install -g pnpm@latest` or use your package manager's update mechanism. For projects using `pnpm` via `node_modules`, update the dependency in your own lockfile. Verify the upgrade with `pnpm --version` and confirm it reports 10.34.0, 11.4.0, or later. Regenerate lockfiles in a trusted environment after upgrading to ensure no residual malicious references. Test dependency resolution, especially for git-based dependencies, in your CI/CD pipeline before full rollout.

Detection guidance

Examine lockfiles (pnpm-lock.yaml) for suspicious commit references in git resolution blocks. Legitimate commit hashes are 40-character hexadecimal strings; look for entries containing `--` or git option flags (e.g., `--upload-pack`, `--exec`). Monitor git fetch and SSH command execution logs in CI/CD environments for unexpected flags or commands. Check project repository history for recent, unexplained lockfile changes. Review SSH and local git dependency usage across projects to identify higher-risk configurations. Implement pre-commit hooks to validate commit reference format and reject anomalous patterns. Log all `pnpm install` executions with version and lockfile checksum for forensic review.

Why prioritize this

Although the CVSS score is MEDIUM (6.4), this vulnerability deserves elevated prioritization in organizations using SSH git dependencies. The core issue—arbitrary code execution during a routine package install—poses significant risk to development and build infrastructure. Projects heavily reliant on private git-based dependencies should patch within days rather than weeks. Even if your current setup uses HTTPS, the lockfile format supports SSH transitions, so advance patching reduces future risk if your dependency configuration evolves. The lack of KEV designation and low active exploitation indicators allow a measured approach, but delaying past mid-July 2026 increases risk as awareness spreads.

Risk score, explained

The CVSS 6.4 rating accounts for: (1) Medium attack complexity (requires lockfile compromise), (2) Low privilege requirement (any user with repository write access), (3) User interaction (developer or CI system must run install), (4) High confidentiality and integrity impact (arbitrary code execution), and (5) No availability impact. The score appropriately reflects the attack surface limitation (SSH/local only, not HTTPS), but does not fully capture the severity of code execution in trusted build environments. For organizations where developers or CI/CD runs as a privileged account, or where the build server has production access, effective risk is higher than the base score suggests.

Frequently asked questions