pnpm skips integrity verification when the lockfile's integrity field is absent, enabling an attacker who modifies pnpm-lock.yaml and supplies altered package content via the referenced registry to install tampered packages silently. The issue is identified by the CVE as CWE-494 and CWE-354, reflecting missing integrity checks and exception handling concerns.

Environments using pnpm versions earlier than 10.34.0 or 11.4.0 are affected. The vulnerability applies to the pnpm package manager component; any project that relies on a lockfile lacking integrity fields is at risk.

The CVSS score of 6.8 indicates moderate risk, and the EPSS score of < 1% shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to modify pnpm-lock.yaml and supply a malicious package from a registry that matches the lockfile entry, then run pnpm install --frozen-lockfile. The likely attack vector involves compromised or malicious repositories or local tampering of the lockfile before installation.