CVE-2026-55699

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Published

Jun 25, 2026, 4:44:32 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.45% · Oct 25, 2026

A flaw was found in pnpm, a package manager. When a malicious package with specially crafted manifest bin object keys (such as "." or "..") is installed globally, subsequent package management operations like removal, update, or replacement could lead to the deletion of critical directories. This could allow an attacker to cause a Denial of Service (DoS) by targeting the global bin directory or its parent. pnpm: pnpm: Denial of Service due to improper handling of malicious package manifest bin keys This Moderate severity flaw in pnpm, a package manager, could lead to a Denial of Service. When a malicious package with specially crafted manifest bin object keys is installed globally, subsequent package management operations can inadvertently delete critical system directories, including the global bin directory or its parent. This requires an attacker to first trick a user into installing a malicious package globally, limiting the immediate exploitability in typical Red Hat deployments. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.