CVE-2026-55697

[CVE catalog]

A flaw was found in pnpm, a package manager. A remote attacker could exploit this vulnerability by crafting a malicious repository that declares a configDependency in its pnpm-workspace.yaml file. When a user installs packages from this repository, pnpm improperly treats the declared dependency as an install-engine opt-in, leading to the execution of a malicious binary. This allows for arbitrary code execution on the system of the developer or continuous integration (CI) user. pnpm: pnpm: Arbitrary code execution via improper handling of config dependencies This is an Important arbitrary code execution flaw in pnpm, a package manager. A remote attacker could exploit this by crafting a malicious repository that, when used by a developer or CI system, leads to the execution of a malicious binary. This vulnerability arises from pnpm's improper handling of `configDependencies` declared in `pnpm-workspace.yaml`, allowing an untrusted repository to opt into a native install engine. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Published

Jun 25, 2026, 4:42:08 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.19% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "pnpm",
      "ecosystem": "cpe",
      "fixed_version": "10.34.2"
    },
    {
      "name": "pnpm",
      "ecosystem": "cpe",
      "fixed_version": "11.5.3"
    },
    {
      "name": "pnpm",
      "ecosystem": "npm",
      "fixed_version": "11.5.3",
      "provider_record_id": "GHSA-GJ8W-MVPF-X27X"
    }
  ]
}