pnpm CVE-2026-55700

Exploitation requires the victim to invoke the pnpm stage download command (a release-staging subcommand) against a registry the attacker controls or has compromised, with pnpm version between 11.3.0 and 11.5.2. The attacker must control the staged tarball manifest's name and/or version fields and embed path-separator/../ sequences there. Limiting factors: user interaction is required (CVSS UI:R) - the attack does not trigger on a normal pnpm install, only on the specialized stage-download workflow; the overwrite target is constrained to paths reachable/writable by the user running the command; and exploitation presupposes a malicious or breached registry in the trust path.

The provided CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L): network vector, low complexity, no attacker privileges, but user interaction required, with high integrity and low availability impact and no confidentiality loss - consistent with a file-overwrite primitive rather than direct data theft or code execution. The key limiting factor not captured by the raw score is the threat model: exploitation requires the victim to run pnpm stage download against a registry the attacker controls or has compromised, and pnpm stage is a niche release-staging workflow, not a routine install. No EPSS score, KEV listing, or SSVC decision data was provided, so widespread automated exploitation cannot be assessed from the input; the absence of KEV/POC signals plus the specialized command make this a moderate, targeted-supply-chain risk rather than an urgent mass-exploitation event. The file-overwrite could escalate to code execution if a writable startup script or config is targeted, which is why integrity is rated High.

An attacker who controls or has compromised a registry serving staged tarballs publishes a manifest whose name or version field contains path-traversal sequences (e.g. version 1.0.0/../../.bashrc). When a developer or CI job runs pnpm stage download <stageId> against that registry, pnpm derives the output path from the manifest and writes the tarball bytes outside the intended directory, overwriting a reachable file. The fixing PR ships test cases demonstrating the traversal, but no weaponized public exploit was identified at time of analysis.