Back to overview

CVE-2026-55698

HIGH
8.8
CVSS 3.1
Description
pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pnpm-lock.yaml. Before the patch, direct pnpm execution trusted an already resolved packageManagerDependencies entry when the committed env lockfile contained matching pnpm and @pnpm/exe versions. A malicious repository could therefore commit package-manager lockfile package records and snapshots that bypassed fresh package-manager resolution, then cause pnpm to install and execute bytes selected by that committed lockfile state during automatic version switching. This vulnerability is fixed in 10.34.2 and 11.5.3.

Metadata

CVE ID
CVE-2026-55698
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-06-17 00:13 UTC
Published
2026-06-25 16:43 UTC
Last updated
2026-06-25 16:43 UTC
Primary CWE
CWE-345
CWE-345: Insufficient Verification of Data Authenticity
Vendor / Product
pnpm / pnpm
Sources
cve.org  ·  NVD

Severity & Metrics

8.8 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products (1)
VendorProductPlatformVersions
pnpm pnpm — < 10.34.2, >= 11.0.0, < 11.5.3
Weakness (CWE)
CWESourceDescription
CWE-345 cna CWE-345: Insufficient Verification of Data Authenticity
CWE-494 cna CWE-494: Download of Code Without Integrity Check
CWE-829 cna CWE-829: Inclusion of Functionality from Untrusted Control Sphere
CVSS scores (1)
ScoreSeverityVersionSourceVector
8.8 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References (1)
Back to overview