CVE-2026-48995: pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

June 26, 2026

A malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile.

References

github.com/advisories/GHSA-hg3w-7f8c-63hp
github.com/pnpm/pnpm/security/advisories/GHSA-hg3w-7f8c-63hp
nvd.nist.gov/vuln/detail/CVE-2026-48995

Code Behaviors & Features

Detect and mitigate CVE-2026-48995 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →