Listen to this Post
CVE-2026-50021 is a critical vulnerability in the pnpm package manager that allows an attacker to bypass integrity verification for package tarballs. This flaw exists in versions prior to 10.34.0 and 11.4.0.
The vulnerability stems from how the `addTarballToStore` function in `worker/src/start.ts` (lines 189-204) handles the `integrity` field in the lockfile. The function contains a conditional check: if (integrity) { ... }. The `TarballResolution` type declares `integrity` as optional (integrity?: string), meaning the lockfile can legitimately omit this field.
When `pnpm install –frozen-lockfile` runs and encounters a lockfile entry without an `integrity` field, the `if (integrity)` guard evaluates to false, causing the worker to skip hash verification entirely. Instead of failing securely, the worker computes a new hash from the unverified tarball content and stores it as legitimate.
An attacker who can both modify `pnpm-lock.yaml` to remove the `integrity:` field and cause the referenced registry URL to serve altered package content can exploit this gap. The `–frozen-lockfile` flag, which is supposed to ensure deterministic installs, does not fail closed when the integrity field is missing.
This represents a pnpm-specific “fail-open” gap, as npm’s `npm ci` enforces integrity verification by default. The vulnerability aligns with CWE-1037 (Inadequate Integrity Checks) and can be used for supply chain attacks where malicious code is silently injected into development environments and CI/CD pipelines.
DailyCVE Form:
Platform: ……. pnpm
Version: …….. <10.34.0, <11.4.0
Vulnerability :…… Integrity Bypass
Severity: ……. High (CVSS: 6.8)
date: ………. 2026-06-25
Prediction: ……. 2026-06-26
What Undercode Say:
Analytics
- Vulnerable Function: `addTarballToStore` in `worker/src/start.ts` (lines 189-204)
- Root Cause: Optional `integrity` field in `TarballResolution` type
- Attack Vector: Modify lockfile + Compromise registry
- CWE: CWE-354 – Improper Validation of Integrity Check Value
- Fixed Versions: 10.34.0, 11.4.0
Bash Commands & Codes
PoC Exploit Script (from AutoFyn audit):
bash autofyn_audit/exploits/vuln1_integrity_bypass/exploit.sh
Publishes a package, generates lockfile, republishes tampered version, strips integrity field, re-runs `pnpm install –frozen-lockfile`
Vulnerable Code Snippet (`worker/src/start.ts:189-204`):
function addTarballToStore ({ buffer, storeDir, integrity, ... }: TarballExtractMessage) {
if (integrity) { // false when integrity is undefined
const { algorithm, hexDigest } = parseIntegrity(integrity)
const calculatedHash = crypto.hash(algorithm, buffer, 'hex')
if (calculatedHash !== hexDigest) {
return { status: 'error', error: { type: 'integrity_validation_failed', ... } }
}
}
return {
status: 'success',
value: { integrity: integrity ?? calcIntegrity(buffer) },
}
}
The guard skips verification when `integrity` is `undefined`
Detection Command (check for missing integrity fields in lockfile):
grep -B 5 -A 5 "^[[:space:]]integrity:" pnpm-lock.yaml | grep -B 5 "^[[:space:]]integrity:$" || echo "No missing integrity fields found"
Exploit:
- Modify Lockfile: Attacker removes the `integrity:` field from a package entry in `pnpm-lock.yaml`
2. Compromise Registry: Attacker causes the referenced registry URL to serve tampered package content for the same package name and version
3. Trigger Install: Victim runs `pnpm install –frozen-lockfile`
- Bypass Verification: The `if (integrity)` guard evaluates to
false, skipping hash verification - Silent Installation: The worker computes a new hash from the tampered content and stores it as legitimate
- Result: Tampered package is installed without any integrity error
The attack requires the victim to install a package that has an HTTP/git tarball in its dependency tree.
Protection:
- Upgrade immediately to pnpm version 10.34.0 or 11.4.0 (or later)
- Verify lockfile integrity manually by checking for missing `integrity:` fields in `pnpm-lock.yaml`
– Implement registry access controls and network segmentation around package repositories - Regularly audit installed packages for potential compromise
- Consider migrating to npm for CI/CD pipelines where `npm ci` enforces integrity by default
- Monitor for anomalous package installation patterns
Impact:
- Supply Chain Compromise: Attackers can introduce backdoors, malicious dependencies, or corrupted code into applications
- Silent Injection: Malicious code can be installed without triggering security alerts
- Persistent Risk: Creates a lasting security risk within development environments and CI/CD pipelines
- Trust Model Undermined: Breaks the trust model that developers rely upon when using package managers
- Advanced Persistent Threats: Organizations face potential exposure to APTs that can silently introduce malicious code
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
