https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:32:03 +0000 https://db.gcve.eu/vuln/cve-2026-50021 <p><strong>Affected:</strong> pnpm</p> <p>pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm&#39;s tarball extraction worker skips integrity verification when the integrity field is absent from the lockfile resolution. If an attacker can both modify pnpm-lock.yaml to remove the integrity: field and cause the referenced registry URL to serve altered package content, pnpm install --frozen-lockfile can install the altered package without an integrity error. npm&#39;s npm ci enforces integrity by default; pnpm&#39;s behavior of silently skipping verification is a pnpm-specific fail-open gap. This vulnerability is fixed in 10.34.0 and 11.4.0.</p> <p><strong>Affected:</strong> pnpm</p> <p>pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm&#39;s tarball extraction worker skips integrity verification when the integrity field is absent from the lockfile resolution. If an attacker can both modify pnpm-lock.yaml to remove the integrity: field and cause the referenced registry URL to serve altered package content, pnpm install --frozen-lockfile can install the altered package without an integrity error. npm&#39;s npm ci enforces integrity by default; pnpm&#39;s behavior of silently skipping verification is a pnpm-specific fail-open gap. This vulnerability is fixed in 10.34.0 and 11.4.0.</p> https://db.gcve.eu/vuln/cve-2026-50021 https://db.gcve.eu/vuln/ghsa-q6j5-fjx5-2mc3 <p><strong>Affected:</strong> npm: pnpm</p> <p>## Summary</p> <p>pnpm&#39;s tarball extraction worker skips integrity verification when the `integrity` field is absent from the lockfile resolution. If an attacker can both modify `pnpm-lock.yaml` to remove the `integrity:` field and cause the referenced registry URL to serve altered package content, `pnpm install --frozen-lockfile` can install the altered package without an integrity error. npm&#39;s `npm ci` enforces integrity by default; pnpm&#39;s behavior of silently skipping verification is a pnpm-specific fail-open gap.</p> <p>## Vulnerability Details</p> <p>The `addTarballToStore` function in `worker/src/start.ts` (lines 189-204) checks `if (integrity)` before verifying the tarball hash. The `TarballResolution` type declares `integrity` as optional (`integrity?: string`). When the lockfile omits the `integrity` field, the guard evaluates to `false`, skipping hash verification entirely. The worker then computes a new hash from the unverified content and stores it as legitimate.</p> <p>```typescript // worker/src/start.ts:189-204 function addTarballToStore ({ buffer, storeDir, integrity, ... }: TarballExtractMessage) { if (integrity) { // false when integrity is undefined const { algorithm, hexDigest } = parseIntegrity(integrity) const calculatedHash = crypto.hash(algorithm, buffer, &#39;hex&#39;) if (calculatedHash !== hexDigest) { return { status: &#39;error&#39;, error: { type: &#39;integrity_validation_failed&#39;, ... } } } } return { status: &#39;success&#39;, value: { integrity: in…</p> <p><strong>Affected:</strong> npm: pnpm</p> <p>## Summary</p> <p>pnpm&#39;s tarball extraction worker skips integrity verification when the `integrity` field is absent from the lockfile resolution. If an attacker can both modify `pnpm-lock.yaml` to remove the `integrity:` field and cause the referenced registry URL to serve altered package content, `pnpm install --frozen-lockfile` can install the altered package without an integrity error. npm&#39;s `npm ci` enforces integrity by default; pnpm&#39;s behavior of silently skipping verification is a pnpm-specific fail-open gap.</p> <p>## Vulnerability Details</p> <p>The `addTarballToStore` function in `worker/src/start.ts` (lines 189-204) checks `if (integrity)` before verifying the tarball hash. The `TarballResolution` type declares `integrity` as optional (`integrity?: string`). When the lockfile omits the `integrity` field, the guard evaluates to `false`, skipping hash verification entirely. The worker then computes a new hash from the unverified content and stores it as legitimate.</p> <p>```typescript // worker/src/start.ts:189-204 function addTarballToStore ({ buffer, storeDir, integrity, ... }: TarballExtractMessage) { if (integrity) { // false when integrity is undefined const { algorithm, hexDigest } = parseIntegrity(integrity) const calculatedHash = crypto.hash(algorithm, buffer, &#39;hex&#39;) if (calculatedHash !== hexDigest) { return { status: &#39;error&#39;, error: { type: &#39;integrity_validation_failed&#39;, ... } } } } return { status: &#39;success&#39;, value: { integrity: in…</p> https://db.gcve.eu/vuln/ghsa-q6j5-fjx5-2mc3