CVE-2026-55700
1 advisory.
npm/pnpm CVE-2026-55700: high 7.1
pnpm: `stage download` writes outside its destination directory via manifest name/version traversal
Action: Upgrade pnpm to 11.5.3 or later.
npm i pnpm@11.5.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 11.3.0 | 11.5.3 | - |
Fixed versions
| 11.5.3 |
Sources
- osv: GHSA-v23m-ccfg-pq9h
- https://github.com/pnpm/pnpm/security/advisories/GHSA-v23m-ccfg-pq9h
- https://nvd.nist.gov/vuln/detail/CVE-2026-55700
- https://github.com/pnpm/pnpm/pull/12303
- https://github.com/pnpm/pnpm
CVE-2026-55700 · published · modified · JSON