{"items":[{"id":"NVI-00017582","kind":"vulnerability","title":"pnpm: Git Fetch Argument Injection via Lockfile resolution.commit","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-p4xf-rf54-rj3x","CVE-2026-50014"],"plain_summary":"GitHub lists this reviewed advisory for pnpm, pnpm. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2709732f42e12406a68f96d643821cf3"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-26T22:53:22.000Z","value":"6.4 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-2709732f42e12406a68f96d643821cf3"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2709732f42e12406a68f96d643821cf3","url":"https://github.com/advisories/GHSA-p4xf-rf54-rj3x","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-p4xf-rf54-rj3x","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T19:05:04.022Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2709732f42e12406a68f96d643821cf3"],"technology":"pnpm","known_exclusions":[],"conditions_summary":"## Summary\n\npnpm passes the lockfile-controlled git `resolution.commit` value to `git fetch` without a `--` separator or commit-format validation. For git dependencies fetched through the shallow-fetch path, a malicious lockfile can replace the expected 40-character commit hash with a Git option such as `--upload-pack=`. For SSH and local transports, `--upload-pack` can execute the supplied command. HTTPS transports ignore `--upload-pack`, so the practical attack surface is primarily SSH or local git dependencies.\n\n## Vulnerability Details\n\nThe vulnerable path is in `fetching/git-fetcher/src/index.ts`. When a git dependency host is configured for shallow fetching, pnpm calls:\n\n```typescript\nawait execGit(['fetch', '--depth', '1', 'origin', resolution.commit], { cwd: tempLocation })\n```\n\nBecause `resolution.commit` is appended before a `--` separator, Git can parse a commit value beginning with `-` as an option. The same file later passes the value to `git checkout` without a separator:\n\n```typescript\nawait execGit(['checkout', resolution.commit], { cwd: tempLocation })\n```\n\n`resolution.commit` comes from the lockfile and is typed as a plain `string`; pnpm does not validate","public_affected_ranges":["< 10.34.0"]},{"certainty":"source_listed","source_ids":["sr-2709732f42e12406a68f96d643821cf3"],"technology":"pnpm","known_exclusions":[],"conditions_summary":"## Summary\n\npnpm passes the lockfile-controlled git `resolution.commit` value to `git fetch` without a `--` separator or commit-format validation. For git dependencies fetched through the shallow-fetch path, a malicious lockfile can replace the expected 40-character commit hash with a Git option such as `--upload-pack=`. For SSH and local transports, `--upload-pack` can execute the supplied command. HTTPS transports ignore `--upload-pack`, so the practical attack surface is primarily SSH or local git dependencies.\n\n## Vulnerability Details\n\nThe vulnerable path is in `fetching/git-fetcher/src/index.ts`. When a git dependency host is configured for shallow fetching, pnpm calls:\n\n```typescript\nawait execGit(['fetch', '--depth', '1', 'origin', resolution.commit], { cwd: tempLocation })\n```\n\nBecause `resolution.commit` is appended before a `--` separator, Git can parse a commit value beginning with `-` as an option. The same file later passes the value to `git checkout` without a separator:\n\n```typescript\nawait execGit(['checkout', resolution.commit], { cwd: tempLocation })\n```\n\n`resolution.commit` comes from the lockfile and is typed as a plain `string`; pnpm does not validate","public_affected_ranges":[">= 11.0.0, < 11.4.0"]}],"null_published_at":"2026-11-05T19:10:21.422Z","source_updated_at":"2026-06-26T22:53:22.000Z","source_disclosed_at":"2026-06-26T22:53:21.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T19:05:04.022Z"}],"next_cursor":null,"snapshot_revision":"42594"}