Read the docs
TI-2026-40214 Aliases CVE-2026-55700GHSA-v23m-ccfg-pq9h

pnpm: stage download writes outside destination via manifest version traversal

Priority LOW 31CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file. The merged fix validates both fields, derives one safe filename, and verifies the final destination before writing. This vulnerability is fixed in 11.5.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00417 36th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed pnpm (pnpm): 11.5.3pnpm (npm): 11.5.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pnpmpnpm11.3.0 to before 11.5.311.5.3Patch availableCNA
—pnpm (npm)11.3.0 to before 11.5.311.5.3Patch availableGHSA-v23m-ccfg-pq9h
  • pnpm Vendorpnpm Affected 11.3.0 to before 11.5.3 Fixed in 11.5.3 Patch available CNA
  • pnpm (npm) Vendor— Affected 11.3.0 to before 11.5.3 Fixed in 11.5.3 Patch available GHSA-v23m-ccfg-pq9h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:node.js:*:*11.3.0 to before 11.5.3Vulnerablepnpm
  • cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:node.js:*:* Versions 11.3.0 to before 11.5.3 Vulnerable ·pnpm

Remediation

  • Fix · CNA pnpm (pnpm) Fixed in 11.5.3
  • Fix · GHSA-v23m-ccfg-pq9h pnpm (npm) Fixed in 11.5.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat AMQ Broker 7
  • Red Hat Build of Keycloak
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55700
  2. 2026-10-03 Alias added: GHSA-v23m-ccfg-pq9h

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2025-42715 pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default" CVSS 3.1CRITICAL 9.8
  • TI-2023-19086 pnpm incorrectly parses tar archives relative to specification CVSS 3.1CRITICAL 9.8
  • TI-2026-40212 pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes CVSS 3.1HIGH 8.8
  • TI-2026-40211 pnpm: Repository-controlled configDependencies can select a pacquet native install engine CVSS 3.1HIGH 8.8
  • TI-2026-40042 pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle CVSS 3.1HIGH 8.8
  • TI-2026-36842 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement CVSS 3.1HIGH 8.8
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences