CVE-2026-55698 Details
Description
pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pnpm-lock.yaml. Before the patch, direct pnpm execution trusted an already resolved packageManagerDependencies entry when the committed env lockfile contained matching pnpm and @pnpm/exe versions. A malicious repository could therefore commit package-manager lockfile package records and snapshots that bypassed fresh package-manager resolution, then cause pnpm to install and execute bytes selected by that committed lockfile state during automatic version switching. This vulnerability is fixed in 10.34.2 and 11.5.3.
A vulnerability exists in the pnpm package manager, specifically in versions prior to 10.34.2 and 11.5.3. This issue allows pnpm to retain package-manager bootstrap metadata in the first YAML document of the pnpm-lock.yaml file. Before the vulnerability was patched, direct execution of pnpm would trust an already resolved packageManagerDependencies entry if the committed environment lockfile matched the pnpm and @pnpm/exe versions. As a result, a malicious repository could commit package records and snapshots that circumvented fresh package-manager resolution, leading pnpm to install and execute code specified by the compromised lockfile during automatic version switching.
Users can update to pnpm versions 10.34.2 or 11.5.3 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pnpm/pnpm/security/advisories/GHSA-w466-c33r-3gjp | CISA-ADP | ExploitVendor Advisory |
| https://github.com/pnpm/pnpm/security/advisories/GHSA-w466-c33r-3gjp | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-494 | Download of Code Without Integrity Check | [email protected] |
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pnpm pnpm | < 10.34.2 >= 11.0.0, < 11.5.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 30, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |