This vulnerability arises because the pnpm lockfile does not store the hash for tarball dependencies fetched from codeload.github.com. When that server is compromised or a user's network environment is malicious, pnpm will download and install the supplied tarball without verifying its integrity, potentially allowing arbitrary code to run during the installation process. The weakness is classified as CWE‑353, a hash or integrity check failure, which directly enables tampering with dependency packages.

pnpm package manager, versions earlier than 10.33.4 and earlier than 11.0.7. These releases lack the hash verification for GitHub git dependencies and are therefore vulnerable.

The CVSS score of 4.8 indicates medium severity. The EPSS score is not available, suggesting that exploitation data is scarce at this time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a compromised codeload.github.com server or a malicious local network configuration; a standard attacker would need control over that server or the user’s environment to deliver a malicious tarball. Given the medium CVSS score and the need for environmental manipulation, the overall risk remains moderate but should be addressed promptly.