CVE-2026-55699

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.2 pnpm versions prior to 11.5.3

Description Manifest bin object keys such as "", ".", and ".." bypass the bin-name guard. If a malicious package is installed globally, subsequent global remove, update, or add-replacement operations can re-derive these names from the installed manifest. This allows the software to pass path.join(globalBinDir, binName) to the removeBin() function. Consequently, using "." targets the global bin directory, while ".." targets its parent directory.

Recommendations Update to version 10.34.2. Update to version 11.5.3.