CVE-2026-50573— pnpm 不安全默认行为导致完整性检查被破坏
Possible ATT&CK Techniques 1AI
T1195.002 · Compromise Software Supply Chain新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-50573の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
pnpm: Unsafe default behavior breaks integrity check
ソース: NVD (National Vulnerability Database)
脆弱性説明
pnpm is a package manager. Prior to 10.34.0 and 11.4.0, `pnpm install` in non-frozen mode can accept new remote package content after detecting that the downloaded tarball does not match the integrity recorded in pnpm-lock.yaml. When a package is already locked with an integrity value, and the registry later serves different metadata and tarball content for the same package name and version, pnpm initially reports an integrity mismatch. However, plain pnpm install then performs a resolution repair, accepts the registry's new integrity, updates the lockfile, installs the new content, and exits successfully. This means the lockfile integrity check does not act as a hard stop by default. This vulnerability is fixed in 10.34.0 and 11.4.0.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
对数据真实性的验证不充分
ソース: NVD (National Vulnerability Database)
影響を受ける製品
II. CVE-2026-50573の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-50573のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-50573 其他参考 (1)
Same Patch Batch · pnpm · 2026-06-25 · 13 CVEs total
| CVE-2026-50016 | 8.8 HIGH | pnpm: Transitive dependency alias path traversal allows project path override via symlink |
| CVE-2026-55698 | 8.8 HIGH | pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfi |
| CVE-2026-55487 | 7.5 HIGH | pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle |
| CVE-2026-55697 | 7.5 HIGH | pnpm: Repository-controlled configDependencies can select a pacquet native install engine |
| CVE-2026-50015 | 7.3 HIGH | pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal) |
| CVE-2026-55700 | 7.1 HIGH | pnpm: stage download writes outside destination via manifest version traversal |
| CVE-2026-50021 | 6.8 MEDIUM | pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field |
| CVE-2026-55180 | 6.5 MEDIUM | pnpm: Repository config can expand victim environment secrets into registry requests befor |
| CVE-2026-55699 | 6.5 MEDIUM | pnpm: reserved bin name deletes PNPM_HOME during global remove |
| CVE-2026-50014 | 6.4 MEDIUM | pnpm: Git Fetch Argument Injection via Lockfile resolution.commit |
| CVE-2026-48995 | pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile | |
| CVE-2026-50017 | pnpm binds unscoped user-level npm auth credentials to a repository-selected registry |
IV. 関連脆弱性
同じ製品: pnpm
- CVE-2026-55180
pnpm: Repository config can expand victim environment secret - CVE-2026-48995
pnpm: Tarball hash of GitHub git dependencies is not stored - CVE-2026-50017
pnpm binds unscoped user-level npm auth credentials to a rep - CVE-2026-50016
pnpm: Transitive dependency alias path traversal allows proj - CVE-2026-50015
pnpm: Arbitrary File Write/Delete via Malicious Patch File (
同じベンダー: pnpm
- CVE-2026-55180
pnpm: Repository config can expand victim environment secret - CVE-2026-48995
pnpm: Tarball hash of GitHub git dependencies is not stored - CVE-2026-50017
pnpm binds unscoped user-level npm auth credentials to a rep - CVE-2026-50016
pnpm: Transitive dependency alias path traversal allows proj - CVE-2026-50015
pnpm: Arbitrary File Write/Delete via Malicious Patch File (
同じ弱点: CWE-345
- CVE-2026-55698
pnpm: Project env lockfile can short-circuit package-manager - CVE-2026-52812
Gogs: LFS dedupe path leaks private repo content across tena - CVE-2026-45792
RTK improperly trusts project-local filter configuration, al - CVE-2026-47155
vLLM: Artifact Pin Decay in vLLM allows pinned deployments t - CVE-2026-54288
Hono: Body Limit Middleware can be bypassed on AWS Lambda by
V. CVE-2026-50573へのコメント
まだコメントはありません