Security vulnerabilities and automated fixes for pnpm issues
26 posts found
The `pnpm-workspace.yaml` file in this Node.js library was missing the `trustPolicy` setting, leaving the workspace without protection against publisher-trust downgrade attacks introduced in pnpm 10.21.0. Adding `trustPolicy: no-downgrade` ensures that once a package's publisher trust evidence is established, a later malicious or compromised release cannot silently weaken it during an install or update.
A pnpm workspace configuration was missing the `minimumReleaseAge` setting, leaving the project vulnerable to supply chain attacks from newly published malicious or compromised npm packages. By adding `minimumReleaseAge: 10080` (seven days in minutes), the fix ensures that only packages that have survived community scrutiny for at least a week are resolved during installation. This defensive hardening is especially critical for web applications where a compromised dependency could introduce XSS,
CVE-2026-9277 is a critical command injection vulnerability in shell-quote 1.8.3 that allows attackers to execute arbitrary code through unescaped line terminators. The fix upgrades to version 1.9.0, which properly escapes these characters and prevents shell command manipulation.
A critical supply chain vulnerability in a pnpm workspace configuration allowed immediate installation of newly published packages, exposing downstream consumers to potentially malicious dependencies. The fix adds `minimumReleaseAge: 10080` and two additional hardening directives to enforce a seven-day quarantine period.
A high-severity algorithmic complexity vulnerability (GHSA-5p4m-2wfm-xmqj) in js-yaml versions 3.x through 4.3.0 allows attackers to trigger quadratic CPU consumption through specially crafted `!!omap` YAML sequences. The fix upgrades js-yaml to 4.3.1 using a pnpm override in the `e2e/adapter/claude-code` package, ensuring all transitive dependencies also receive the patched version. This proactive patch eliminates an exploit primitive before it can be chained with other weaknesses.
A Node.js library's pnpm workspace configuration lacked the `minimumReleaseAge` setting, leaving it vulnerable to malicious or unstable newly-published packages. By adding a 7-day waiting period (10,080 minutes) along with additional hardening measures like `blockExoticSubdeps` and `trustPolicy`, the project now has robust defense against supply chain attacks targeting its dependencies.
A pnpm workspace configuration was missing the `minimumReleaseAge` setting, allowing freshly published (and potentially malicious) package versions to be installed immediately. The fix adds a 7-day quarantine period along with `blockExoticSubdeps` and `trustPolicy: no-downgrade` to harden the supply chain against package takeover attacks.
CVE-2026-9277 is a critical command injection vulnerability in the `shell-quote` npm package (versions prior to 1.8.4) caused by unescaped line terminators that allow attackers to inject and execute arbitrary shell commands. The fix pins `shell-quote` to `>=1.8.4` via a `pnpm.overrides` entry, ensuring every transitive consumer in the dependency tree receives the patched version. Any Node.js project that processes user-influenced input through `shell-quote` and has not yet upgraded is at risk of
A missing `minimumReleaseAge` setting in `pnpm-workspace.yaml` left this Node.js workspace vulnerable to immediately installing newly published — potentially malicious — package versions. The fix adds `minimumReleaseAge: 10080` (7 days in minutes) to enforce a quarantine window before any freshly published package can be installed. This single configuration change significantly reduces the risk of supply chain attacks targeting the package publishing pipeline.
A pnpm workspace configuration had `minimumReleaseAge` set to `0`, meaning newly published npm packages could be installed immediately—before the community has time to detect malicious or compromised releases. By changing this value to `10080` (seven days in minutes), the project now enforces a quarantine window that dramatically reduces exposure to typosquatting, dependency confusion, and post-publish malware injection attacks.
CVE-2026-35209 is a high-severity prototype pollution vulnerability in the `defu` JavaScript library (versions prior to 6.1.5), where a crafted `__proto__` key in the defaults argument can corrupt the global Object prototype. The fix upgrades `defu` from 6.1.4 to 6.1.5 in `pnpm-lock.yaml` and enforces the version via a workspace override, closing the attack surface in production code that depends on `defu` for deep object merging.
A vulnerability in the `tmp` Node.js package (CVE-2026-44705) was discovered lurking as a transitive dependency via `tmp-promise@3.0.3`, leaving applications exposed to unsafe temporary file handling. The fix pins `tmp` to version `0.2.7` using a pnpm override across `package.json`, `dist/cli.js`, and `pnpm-lock.yaml`, eliminating the vulnerable code path without affecting any valid application behavior.