Path Traversal and Arbitrary File Creation in pnpm Package Manager by PNPM Inc.

CVE-2026-55699

What is CVE-2026-55699?

The pnpm package manager is susceptible to a path traversal vulnerability due to improper handling of bin object keys in its manifest. Specifically, prior to versions 10.34.2 and 11.5.3, keys such as '', '.', and '..' could bypass pnpm's bin-name guard when a malicious package was globally installed. Consequently, during operations like global removal or updates, these problematic paths could be re-derived from the manifest, potentially leading to arbitrary file creation in unintended directories, including the global bin directory and its parent. This vulnerability highlights the importance of strict input validation and proper sanitization processes in package management to prevent exploitation.

References