CVE-2026-55698

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.2 pnpm versions 11.0.0 through 11.5.2

Description pnpm can persist package-manager bootstrap metadata in the first YAML document of the pnpm-lock.yaml file. The issue occurs when pnpm incorrectly trusts an already resolved packageManagerDependencies entry if the committed environment lockfile contains matching pnpm and @pnpm/exe versions. This trust failure during automatic version switching allows a malicious repository to commit crafted lockfile package records and snapshots that bypass fresh package-manager resolution.

An attacker can exploit this by committing a crafted pnpm-lock.yaml file. When a victim runs pnpm in that repository with auto-switching enabled, pnpm may install and execute attacker-selected bytes. This can lead to arbitrary code execution with the privileges of the user, potentially compromising developer workstations and CI runners.

Technical details include the following:

Recommendations Upgrade pnpm to version 10.34.2. Upgrade pnpm to version 11.5.3.