Security Flaw in pnpm Package Manager Affecting Multiple Versions
CVE-2026-55697

7.5HIGH

Key Information:

Vendor

Pnpm

Status
Pnpm
Vendor
CVE Published:
25 June 2026

What is CVE-2026-55697?

pnpm, a popular package manager, is vulnerable due to its handling of configDependencies declared in the pnpm-workspace.yaml file. Prior to versions 10.34.2 and 11.5.3, pnpm allowed repositories to declare dependencies that were treated as optional installation triggers. This unintended behavior could lead to the execution of platform-specific binaries from user-defined repositories, increasing the risk of unauthorized code execution. The vulnerability allows an attacker to exploit the installation process by controlling the configuration, ultimately allowing potentially malicious scripts to run under the context of the developer or CI/CD user. Users are advised to upgrade to the patched versions to mitigate this issue.

Affected Version(s)

pnpm < 10.34.2 < 10.34.2

pnpm >= 11.0.0, < 11.5.3 < 11.0.0, 11.5.3

References

https://github.com/pnpm/pnpm/security/advisories/GHSA-gj8...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.