Path traversal in pnpm - CVE-2026-55700
Published: June 15, 2026
Vulnerability identifier: #VU134555
CSH Severity: Medium
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55700
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to overwrite files outside the selected download directory.
The vulnerability exists due to path traversal in pnpm stage download when deriving a local filename from registry-controlled package name and version fields. A remote attacker can supply a crafted manifest to overwrite files outside the selected download directory.
User interaction is required to run the stage download command on the crafted package.
Affected software
pnpm
How to mitigate CVE-2026-55700
Install security update from vendor's website.
pnpm - update to 11.5.3