CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2026-55698
High (8.8) in pnpm pnpm. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in pnpm 10.34.2, 11.5.3.
pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pnpm-lock.yaml. Before the patch, direct pnpm execution trusted an already resolved packageManagerDependencies entry when the committed env lockfile contained matching pnpm and @pnpm/exe versions. A malicious repository could therefore commit package-manager lockfile package records and snapshots that bypassed fresh package-manager resolution, then cause pnpm to install and execute bytes selected by that committed lockfile state during automatic version switching. This vulnerability is fixed in 10.34.2 and 11.5.3.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-345, CWE-494, CWE-829
- Published
- Modified
- Record from
- the NVD, synced
Affected
- pnpm:pnpm
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-w466-c33r-3gjp | npm | pnpm | <10.34.2 | 10.34.2 |
| GHSA-w466-c33r-3gjp | npm | pnpm | >=11.0.0 <11.5.3 | 11.5.3 |