pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes (CVE-2026-55698)
Description
pnpm versions prior to 10.34.2 and 11.5.3 contain a vulnerability where the project environment lockfile (pnpm-lock.yaml) can be manipulated to bypass package-manager resolution. This allows a malicious repository to commit lockfile entries that cause pnpm to install and execute arbitrary bytes during automatic version switching. The issue is fixed in versions 10.34.2 and 11.5.3.
CVSS v3.1
Score 8.8high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
pnpm, a package manager, persisted package-manager bootstrap metadata in the first YAML document of pnpm-lock.yaml before versions 10.34.2 and 11.5.3. Direct pnpm execution trusted the packageManagerDependencies entry in the committed env lockfile when matching pnpm and @pnpm/exe versions were present. A malicious repository could exploit this by committing crafted package-manager lockfile package records and snapshots that bypass fresh package-manager resolution, leading pnpm to install and execute bytes selected by the lockfile state during automatic version switching. This vulnerability is addressed in pnpm versions 10.34.2 and 11.5.3.
Potential Impact
An attacker controlling a repository can commit malicious lockfile entries that cause pnpm to execute arbitrary code during automatic version switching without fresh package-manager resolution. This can lead to full compromise of the environment where pnpm runs, impacting confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade pnpm to version 10.34.2 or later, or 11.5.3 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-pnpm-CVE-2026-55698
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac2c0ae2cdf04f656523451
Added to database: 10/04/2026, 21:10:06 UTC
Last enriched: 10/04/2026, 21:16:20 UTC
Last updated: 10/05/2026, 06:48:17 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.