Arbitrary Code Execution Vulnerability in pnpm Package Manager
CVE-2026-55698

8.8HIGH

Key Information:

Vendor

Pnpm

Status
Pnpm
Vendor
CVE Published:
25 June 2026

What is CVE-2026-55698?

pnpm, a popular package manager, contains a vulnerability that allows arbitrary code execution due to improper handling of bootstrap metadata within the pnpm-lock.yaml file. Versions prior to 10.34.2 and 11.5.3 have been found to trust certain entries in the lockfile, potentially allowing malicious repositories to manipulate package records. This manipulation can result in the installation and execution of unverified code during package resolution. Users are encouraged to upgrade to patched versions to mitigate this risk.

Affected Version(s)

pnpm < 10.34.2 < 10.34.2

pnpm >= 11.0.0, < 11.5.3 < 11.0.0, 11.5.3

References

https://github.com/pnpm/pnpm/security/advisories/GHSA-w46...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.