pnpm CVE-2026-55697

Exploitation requires the victim to run pnpm install (UI:R) on an attacker-controlled repository whose pnpm-workspace.yaml declares pacquet or @pnpm/pacquet as a configDependency, and which supplies a malicious @pacquet/<platform>-<arch>/pacquet native binary matching the victim's platform/arch. The attacker needs no authentication or privileges on the victim system (PR:N), but does need to deliver the malicious repo and get it installed; it only triggers on pnpm versions before 10.34.2 / 11.5.3, since patched versions no longer treat the repository-controlled config dependency as an install-engine opt-in. The principal limiting factors are the required install action and the platform-specific binary the attacker must provide.

Signals are mixed but lean toward a real, situational priority for developer and CI/CD environments. CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact with no privileges required, but the UI:R requirement (a victim must clone and install a malicious repo) materially gates exploitation. SSVC aligns with this: Exploitation=poc, Automatable=no, Technical Impact=total - total impact but not mass-automatable, consistent with targeted supply-chain or social-engineering use rather than internet-wide scanning. EPSS is very low at 0.12% (2nd percentile), and the CVE is not in CISA KEV, so there is no evidence of active in-the-wild exploitation despite public POC code. The 'network' attack vector is somewhat optimistic here - exploitation is really delivery-via-repository plus a local install action - so defenders should read AV:N as 'attacker-controlled repo content' rather than a remote service exposure.

An attacker publishes or contributes to a repository whose pnpm-workspace.yaml declares pacquet (or @pnpm/pacquet) as a config dependency and ships a malicious @pacquet/<platform>-<arch>/pacquet native binary. A developer or CI pipeline clones the repo and runs pnpm install, at which point pnpm resolves and spawns the attacker's binary with the developer/CI user's privileges, achieving code execution. Public exploit code exists, and the low attack complexity (AC:L) means no special timing or conditions are needed beyond the victim performing the install.