What is the CVSS score of CVE-2026-55697?

CVE-2026-55697 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of pnpm are affected by CVE-2026-55697?

pnpm versions before 10.34.2 and 11.5.3 enable arbitrary code execution on developer machines and CI/CD systems during routine package installation from malicious repositories.. A patch is available.

Is there a public PoC exploit available for CVE-2026-55697?

Yes, a public proof-of-concept exploit is available for CVE-2026-55697. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-55697?

Within 24 hours: Identify all projects using pnpm and document current versions in use. Within 7 days: Update pnpm to version 10.34.2 (for 10.x users) or 11.5.3 (for 11.x users) across all development environments and CI/CD systems, then re-run dependency security audits. Within 30 days: Audit build artifacts and code provenance from the past 90 days to identify any potential compromises.

pnpm CVE-2026-55697

EUVD-2026-39483 HIGH

OS Command Injection (CWE-78)

2026-06-25 GitHub_M

GHSA-gj8w-mvpf-x27x

Command Injection Pnpm Red Hat

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

HIGH

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Malicious repo content is network-delivered (AV:N) and trivially triggered (AC:L) with no attacker privileges (PR:N), but requires the victim to run install (UI:R); arbitrary binary execution yields total C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 19:13 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jun 30, 2026 - 19:13 vuln.today

Analysis Updated

Jun 30, 2026 - 19:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 19:07 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 19:07 NVD

7.5 (HIGH) 8.8 (HIGH)

Patch available

Jun 25, 2026 - 19:17 EUVD

Analysis Generated

Jun 25, 2026 - 18:17 vuln.today

DescriptionNVD

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command dispatch. Before the patch, a repository could declare pacquet or @pnpm/pacquet as a config dependency and pnpm treated that repository-controlled dependency as an install-engine opt-in. During install, pnpm resolved a platform-specific @pacquet/<platform>-<arch>/pacquet binary from node_modules/.pnpm-config/<packageName> and spawned it as the developer or CI user. This vulnerability is fixed in 10.34.2 and 11.5.3.

AnalysisAI

Arbitrary command execution in pnpm before 10.34.2 and 11.5.3 allows a malicious repository to run attacker-chosen native binaries as the developer or CI user during a routine install. The flaw stems from pnpm processing configDependencies in pnpm-workspace.yaml before command dispatch: a repo could declare pacquet/@pnpm/pacquet as a config dependency, causing pnpm to resolve a platform-specific @pacquet/<platform>-<arch>/pacquet binary from node_modules/.pnpm-config and spawn it. Publicly available exploit code exists, though EPSS is low (0.12%, 2nd percentile) and it is not in CISA KEV.

Technical ContextAI

pnpm is a widely used JavaScript/Node.js package manager that reads project configuration from pnpm-workspace.yaml, including a configDependencies mechanism intended to let a workspace opt into an alternate install engine (pacquet). The root cause is CWE-78 (OS Command Injection / argument-to-command flow): pnpm trusted a repository-controlled configDependency as an install-engine opt-in and, during install, resolved a native platform-specific binary path (node_modules/.pnpm-config/<packageName>, i.e. @pacquet/<platform>-<arch>/pacquet) and executed it directly. Because this resolution and spawn happened before normal command dispatch and lifecycle-script gating, simply running an install in a hostile repository was enough to execute attacker-supplied code. The CPE cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:*:*:* confirms the pnpm package itself is the affected component.

RemediationAI

Vendor-released patch: upgrade pnpm to 10.34.2 (10.x line) or 11.5.3 (11.x line), as documented in GitHub Security Advisory GHSA-gj8w-mvpf-x27x (https://github.com/pnpm/pnpm/security/advisories/GHSA-gj8w-mvpf-x27x); pin the patched version in CI runner images and developer toolchains. Until upgraded, the practical compensating control is to avoid running pnpm install on untrusted or unreviewed repositories and to audit pnpm-workspace.yaml for any configDependencies entry referencing pacquet or @pnpm/pacquet before installing - removing or rejecting such entries prevents the install-engine opt-in, with the trade-off that legitimate pacquet engine usage would be blocked. Running installs in sandboxed/ephemeral CI containers with no persistent credentials limits blast radius if the binary is spawned, though it does not prevent code execution within that sandbox.