The vulnerability originates from pnpm passing lockfile‑controlled git resolution.commit directly to the git fetch command without proper delimiter or validation. When a malicious lockfile replaces the expected 40‑character commit hash with a git option such as --upload-pack=<command>, an attacker can inject arbitrary git options. For git dependencies retrieved by the shallow‑fetch path over SSH or local transports, the --upload-pack option enables execution of the supplied command on the host that runs pnpm, effectively allowing remote code execution. HTTPS transports ignore the --upload-pack option, so the practical attack surface is limited to SSH or local dependencies.

pnpm package managers released before 10.34.0 and before 11.4.0 are affected. Only the pnpm product is listed as impacted by the CNA.

The CVSS v3.1 score of 6.4 indicates a moderate security impact. No EPSS score is published, so the likelihood of exploit remains uncertain. The vulnerability is not listed in CISA's KEV catalog. An attacker must supply a crafted lockfile that is processed during an npm install operation. If the lockfile references a git repository over SSH or a local path, the injected --upload-pack command will be executed with the permissions of the build environment, potentially allowing the execution of arbitrary code with elevated privileges.