pnpm CVE-2026-55699

The victim must be running pnpm prior to 10.34.2 (v10) or 11.5.3 (v11) and must execute pnpm add -g (or equivalent) to install a malicious package that declares bin object keys of ".", "..", or "" in its package.json. A second triggering condition is required: the victim must subsequently run a global pnpm operation - specifically a global remove, update, or add-replacement - that causes pnpm to re-derive bin names from the already-installed malicious manifest. Exploitation is therefore two-phase and not immediate upon installation. The CVSS PR:N metric confirms no authentication to pnpm itself is required, but the attacker must control or compromise a package in a registry the victim resolves against. Limiting factors include: the requirement for user interaction (UI:R) to initiate both the install and a subsequent global operation; the package must reach a registry accessible to the target; and the pnpm binary itself must be an affected version - pnpm installations that run only local (non-global) installs are not exposed to the vulnerable removeBin path.

The CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H reflects a network-reachable supply-chain delivery path (registry-hosted malicious package) that requires no special privileges, but does require the victim to actively install the package and subsequently trigger a global pnpm operation. The Availability:High rating is severe: destruction of the global bin directory removes all globally installed CLI tools from the user's PATH, potentially breaking CI pipelines, developer toolchains, and automated workflows. No EPSS score was provided in the input, and this CVE is not listed in the CISA KEV catalog, so exploitation probability and confirmed in-the-wild activity are both unconfirmed. No public POC has been identified at time of analysis. However, the supply-chain delivery mechanism significantly amplifies real-world risk: an attacker need only publish a plausible-looking npm-compatible package to a registry pnpm resolves against, making the AC:L rating accurate. The two-step requirement (install then trigger a subsequent global operation) is a realistic operational pattern for developers and CI systems, so UI:R does not substantially reduce practical risk. The absence of KEV listing and POC keeps this below the highest priority tier, but the destructive availability impact and supply-chain vector make it a genuine medium-high priority for any team using pnpm globally.

An attacker publishes a plausible utility package to a public or private registry, embedding a bin object in package.json with the key ".." mapping to an arbitrary executable. A developer or CI pipeline running a vulnerable pnpm version installs this package globally with pnpm add -g <package>. When the developer subsequently runs pnpm remove -g <other-package> or any global update flow, pnpm re-reads the malicious manifest, derives ".." as a bin name, computes path.join(globalBinDir, ".."), and passes the parent of the global bin directory to removeBin - recursively deleting it and every tool it contains.