{"api_version":"v1","generated_at":"2026-10-07T19:40:00+00:00","product":{"cve_count":31,"evidence_gap_note":"Official registry publication history is linked, but a publisher support or retirement boundary has not been established.","id":"security:cve-pnpm-pnpm-3d0d3eaea01e","lifecycle_state":"evidence_gap","linked_lifecycle_url":"https://lifecycle.blacktree.nl/libraries/npm/pnpm","name":"pnpm","next_cursor":null,"observations":[{"affected":"pnpm: 12.0.0-alpha.0 < 12.0.0-alpha.5","affected_versions_present":true,"cve_id":"CVE-2026-101044","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-101044","fixed":"pnpm: 12.0.0-alpha.5","last_modified":"2026-09-30T15:29:02.862Z","patch_url":"https://github.com/pnpm/pnpm/security/advisories/GHSA-2rx9-3g3h-c2jv","primary_source":"","published":"2026-09-27T17:02:33.798Z"},{"affected":"pnpm: 11.0.0 < 11.11.0, 10.7.0 < 10.34.5","affected_versions_present":true,"cve_id":"CVE-2026-101043","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-101043","fixed":"pnpm: 11.11.0, 10.34.5","last_modified":"2026-09-30T15:47:12.588Z","patch_url":"https://github.com/pnpm/pnpm/security/advisories/GHSA-vx52-2968-3vc6","primary_source":"","published":"2026-09-27T17:02:33.119Z"},{"affected":"< 10.34.5; >= 11.0.0, < 11.11.0","affected_versions_present":true,"cve_id":"CVE-2026-82393","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-82393","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-02T03:55:39.345Z","patch_url":"","primary_source":"","published":"2026-08-31T21:12:09.196Z"},{"affected":"< 10.34.5; >= 11.0.0, < 11.11.0","affected_versions_present":true,"cve_id":"CVE-2026-82392","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-82392","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-01T14:57:53.435Z","patch_url":"","primary_source":"","published":"2026-08-31T21:03:25.652Z"},{"affected":"< 10.34.4; >= 11.0.0, < 11.8.0","affected_versions_present":true,"cve_id":"CVE-2026-59195","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-59195","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-07-07T14:06:17.178Z","patch_url":"https://github.com/pnpm/pnpm/security/advisories/GHSA-qrv3-253h-g69c","primary_source":"","published":"2026-07-06T15:21:03.101Z"},{"affected":"< 10.34.4; >= 11.0.0, < 11.7.0","affected_versions_present":true,"cve_id":"CVE-2026-59196","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-59196","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-07-06T15:40:34.708Z","patch_url":"","primary_source":"","published":"2026-07-06T15:18:53.881Z"},{"affected":"< 10.34.4; >= 11.0.0, < 11.7.0","affected_versions_present":true,"cve_id":"CVE-2026-59194","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-59194","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-07-07T16:57:59.326Z","patch_url":"","primary_source":"","published":"2026-07-06T15:16:28.485Z"},{"affected":"< 10.34.2; >= 11.0.0, < 11.5.3","affected_versions_present":true,"cve_id":"CVE-2026-55180","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-55180","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-06-25T17:58:51.463Z","patch_url":"","primary_source":"","published":"2026-06-25T17:00:35.752Z"},{"affected":"< 10.33.4; >= 11.0.0, < 11.0.7","affected_versions_present":true,"cve_id":"CVE-2026-48995","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-48995","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-06-26T02:11:55.249Z","patch_url":"","primary_source":"","published":"2026-06-25T16:58:57.536Z"},{"affected":"< 10.33.4; >= 11.0.0, < 11.4.0","affected_versions_present":true,"cve_id":"CVE-2026-50017","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-50017","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-06-26T18:42:51.869Z","patch_url":"","primary_source":"","published":"2026-06-25T16:56:04.836Z"},{"affected":"< 10.33.4; >= 11.0.0, < 11.4.0","affected_versions_present":true,"cve_id":"CVE-2026-50016","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-50016","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-06-26T03:56:20.337Z","patch_url":"","primary_source":"","published":"2026-06-25T16:53:16.350Z"},{"affected":"< 10.33.4; >= 11.0.0, < 11.4.0","affected_versions_present":true,"cve_id":"CVE-2026-50015","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-50015","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-06-25T17:59:33.209Z","patch_url":"https://github.com/pnpm/pnpm/security/advisories/GHSA-rxhj-4m44-96r4","primary_source":"","published":"2026-06-25T16:52:01.587Z"},{"affected":"< 10.33.4; >= 11.0.0, < 11.4.0","affected_versions_present":true,"cve_id":"CVE-2026-50014","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-50014","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-06-26T03:56:18.879Z","patch_url":"https://github.com/pnpm/pnpm/security/advisories/GHSA-p4xf-rf54-rj3x","primary_source":"","published":"2026-06-25T16:51:16.652Z"},{"affected":"< 10.33.4; >= 11.0.0, < 11.4.0","affected_versions_present":true,"cve_id":"CVE-2026-50573","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-50573","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-06-26T03:56:17.356Z","patch_url":"","primary_source":"","published":"2026-06-25T16:50:21.093Z"},{"affected":"< 10.34.0; >= 11.0.0, < 11.4.0","affected_versions_present":true,"cve_id":"CVE-2026-50021","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-50021","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-06-26T03:56:14.220Z","patch_url":"https://github.com/pnpm/pnpm/security/advisories/GHSA-q6j5-fjx5-2mc3","primary_source":"","published":"2026-06-25T16:48:27.901Z"},{"affected":">= 11.3.0, < 11.5.3","affected_versions_present":true,"cve_id":"CVE-2026-55700","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-55700","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-06-25T18:16:35.788Z","patch_url":"https://github.com/pnpm/pnpm/pull/12303","primary_source":"","published":"2026-06-25T16:47:21.488Z"},{"affected":"< 10.34.2; >= 11.0.0, < 11.5.3","affected_versions_present":true,"cve_id":"CVE-2026-55699","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-55699","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-06-25T17:54:16.980Z","patch_url":"","primary_source":"","published":"2026-06-25T16:44:32.442Z"},{"affected":"< 10.34.2; >= 11.0.0, < 11.5.3","affected_versions_present":true,"cve_id":"CVE-2026-55698","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-55698","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-06-26T03:56:12.858Z","patch_url":"","primary_source":"","published":"2026-06-25T16:43:47.251Z"},{"affected":"< 10.34.2; >= 11.0.0, < 11.5.3","affected_versions_present":true,"cve_id":"CVE-2026-55697","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-55697","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-06-29T15:34:10.905Z","patch_url":"","primary_source":"","published":"2026-06-25T16:42:08.593Z"},{"affected":"< 10.34.2; >= 11.0.0, < 11.5.3","affected_versions_present":true,"cve_id":"CVE-2026-55487","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-55487","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-06-25T18:03:06.773Z","patch_url":"","primary_source":"","published":"2026-06-25T16:41:12.441Z"},{"affected":"< 10.28.2","affected_versions_present":true,"cve_id":"CVE-2026-24131","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-24131","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-01-27T21:37:51.868Z","patch_url":"https://github.com/pnpm/pnpm/commit/17432ad5bbed5c2e77255ca6d56a1449bbcfd943","primary_source":"","published":"2026-01-26T22:03:33.808Z"},{"affected":"< 10.28.2","affected_versions_present":true,"cve_id":"CVE-2026-24056","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-24056","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-01-27T21:39:25.061Z","patch_url":"https://github.com/pnpm/pnpm/commit/b277b45bc35ae77ca72d7634d144bbd58a48b70f","primary_source":"","published":"2026-01-26T21:59:32.287Z"},{"affected":"< 10.28.1","affected_versions_present":true,"cve_id":"CVE-2026-23890","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-23890","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-01-27T21:39:57.954Z","patch_url":"https://github.com/pnpm/pnpm/commit/8afbb1598445d37985d91fda18abb4795ae5062d","primary_source":"","published":"2026-01-26T21:53:40.810Z"},{"affected":"< 10.28.1","affected_versions_present":true,"cve_id":"CVE-2026-23889","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-23889","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-01-27T21:40:36.271Z","patch_url":"https://github.com/pnpm/pnpm/commit/6ca07ffbe6fc0e8b8cdc968f228903ba0886f7c0","primary_source":"","published":"2026-01-26T21:50:55.289Z"},{"affected":"< 10.28.1","affected_versions_present":true,"cve_id":"CVE-2026-23888","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-23888","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-01-27T21:41:06.094Z","patch_url":"https://github.com/pnpm/pnpm/commit/5c382f0ca3b7cc49963b94677426e66539dcb3f5","primary_source":"","published":"2026-01-26T21:37:17.483Z"},{"affected":">=6.25.0, < 10.27.0","affected_versions_present":true,"cve_id":"CVE-2025-69262","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-69262","fixed":"10.27.0.","last_modified":"2026-02-26T15:04:55.349Z","patch_url":"https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx","primary_source":"","published":"2026-01-07T22:30:07.428Z"},{"affected":"pnpm: > 10.0.0, < 10.26.0","affected_versions_present":true,"cve_id":"CVE-2025-69264","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-69264","fixed":"10.26.0.","last_modified":"2026-09-14T12:04:32.632Z","patch_url":"https://github.com/pnpm/pnpm/commit/73cc63504d9bc360c43e4b2feb9080677f03c5b5","primary_source":"","published":"2026-01-07T21:53:09.806Z"},{"affected":"pnpm: < 10.26.0","affected_versions_present":true,"cve_id":"CVE-2025-69263","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-69263","fixed":"10.26.0.","last_modified":"2026-09-14T12:04:25.725Z","patch_url":"https://github.com/pnpm/pnpm/commit/0958027f88a99ccefe7e9676cdebba393dfbdc85","primary_source":"","published":"2026-01-07T21:31:07.567Z"},{"affected":"< 10.0.0","affected_versions_present":true,"cve_id":"CVE-2024-47829","cve_url":"https://cve.blacktree.nl/cve/CVE-2024-47829","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2025-04-23T16:08:45.843Z","patch_url":"","primary_source":"","published":"2025-04-23T15:42:12.623Z"},{"affected":"< 9.15.0","affected_versions_present":true,"cve_id":"CVE-2024-53866","cve_url":"https://cve.blacktree.nl/cve/CVE-2024-53866","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2025-12-31T01:11:35.531Z","patch_url":"https://github.com/pnpm/pnpm/commit/11afcddea48f25ed5117a87dc1780a55222b9743","primary_source":"","published":"2024-12-10T17:12:44.629Z"},{"affected":"< 7.33.4; >= 8.0.0, < 8.6.8","affected_versions_present":true,"cve_id":"CVE-2023-37478","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37478","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2024-10-10T16:00:56.935Z","patch_url":"","primary_source":"","published":"2023-08-01T11:43:04.080Z"}],"source_generated_at":"2026-10-07T06:21:30.017Z","vendor":"pnpm"}}