pnpm up to 11.5.2 Manifest name/version path traversal

Summaryinfo

A vulnerability was found in pnpm up to 11.5.2. It has been declared as critical. Affected is an unknown function of the component Manifest Handler. Such manipulation of the argument name/version leads to path traversal. This vulnerability is listed as CVE-2026-55700. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in pnpm up to 11.5.2. Affected by this issue is some unknown processing of the component Manifest Handler. The manipulation of the argument name/version with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is integrity, and availability. CVE summarizes:

pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file. The merged fix validates both fields, derives one safe filename, and verifies the final destination before writing. This vulnerability is fixed in 11.5.3.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-55700 since 06/17/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 11.5.3 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• pnpm

Version

• 11.5.0
• 11.5.1
• 11.5.2

Website

• Product: https://github.com/pnpm/pnpm/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion