CVE-2026-55700

[CVE catalog]

A flaw was found in pnpm, a package manager. A remote attacker could exploit a vulnerability in the `pnpm stage download` command by providing a specially crafted package manifest. This could allow the attacker to write files to arbitrary locations on the system, leading to unauthorized modification of system files and potential integrity compromise. pnpm: pnpm: Unauthorized file modification via crafted package manifest This Important flaw in pnpm allows a remote attacker to achieve arbitrary file write by providing a specially crafted package manifest during the `pnpm stage download` operation. This could lead to unauthorized modification of system files and compromise system integrity, particularly in environments where pnpm processes untrusted package sources. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

High · CVSS 7.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Published

Jun 25, 2026, 4:47:21 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.42% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "pnpm",
      "ecosystem": "cpe",
      "fixed_version": "11.5.3"
    }
  ]
}