Vulnerability · Published Jun 25, 2026 · Assigned by GitHub_M
CVE-2026-55700pnpm: stage download writes outside destination via manifest version traversal
High 7.1
In plain English
A high-severity path traversal in pnpm from pnpm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file. The merged fix validates both fields, derives one safe filename, and verifies the final destination before writing. This vulnerability is fixed in 11.5.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | pnpm | 11.5.3 | GHSA-v23m-ccfg-pq9h |
Affected products (as reported)
Weakness: CWE-22, CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
References
- https://github.com/pnpm/pnpm/security/advisories/GHSA-v23m-ccfg-pq9h x_refsource_CONFIRM
- https://github.com/pnpm/pnpm/pull/12303 x_refsource_MISC