Path Traversal Vulnerability in pnpm Package Manager

CVE-2026-55700

What is CVE-2026-55700?

The pnpm package manager versions 11.3.0 to 11.5.3 exhibit a vulnerability where, through the pnpm stage download command, crafted manifests can derive local filenames from registry-controlled package names and version fields. This could allow an attacker to escape the designated download directory, leading to the potential overwriting of other accessible files. The issue has been addressed in version 11.5.3, which implements validation for both fields, ensuring that only safe filenames are derived, and verifying the target destination prior to writing any files.

References