CVE-2026-55700 pnpm: stage download writes outside destination via manifest version traversal
A crafted package manifest allows pnpm stage download to write files outside the intended directory, potentially overwriting arbitrary files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-55700?
CVE-2026-55700 is a high-severity path traversal vulnerability in pnpm, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file. The merged fix validates both fields, derives one safe filename, and verifies the final destination before writing. This vulnerability is fixed in 11.5.3.
Which versions are affected by CVE-2026-55700?
2 open source packages ship an affected version, including pnpm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pnpm npm | From 11.3.0 | 11.5.3 |
pnpm npm | From 11.3.0 | 11.5.3 |
Products include Pnpm Pnpm.
How do I fix CVE-2026-55700?
Upgrade pnpm to 11.5.3 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-55700 being exploited?
There is no known exploitation of CVE-2026-55700 in the wild and no public exploit code.
Other vulnerabilities in pnpm
- CVE-2026-50016 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
- CVE-2026-55698 pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes
- CVE-2025-69264 pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
- CVE-2022-26183 Untrusted Search Path in PNPM
- CVE-2026-59195 pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
Sources
Also known as GHSA-v23m-ccfg-pq9h, MINI-3pg3-gp9q-gqgr.