pnpm Lockfile Tampering Leading to Arbitrary Code Execution

Detection Guidance

This vulnerability involves the pnpm package manager trusting manipulated package-manager metadata in the pnpm-lock.yaml file. Detection involves checking for the presence of vulnerable pnpm versions and inspecting the pnpm-lock.yaml file for suspicious or malicious package-manager bootstrap metadata.

You can detect if your system is vulnerable by verifying the installed pnpm version and examining the lockfile for tampering.

• Check pnpm version: `pnpm --version` (versions prior to 10.34.2 and between 11.0.0 and 11.5.3 are vulnerable)
• Inspect the pnpm-lock.yaml file for suspicious entries in the first YAML document, especially the packageManagerDependencies field.
• Use version control tools to review recent changes to pnpm-lock.yaml for unexpected or unreviewed modifications.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-55698 is a high-severity vulnerability in the pnpm package manager affecting versions prior to 10.34.2 and 11.5.3. The issue arises because pnpm trusts package-manager bootstrap metadata stored in the first YAML document of pnpm-lock.yaml without re-resolving it through trusted registries before execution.

A malicious repository can commit a lockfile containing poisoned package records and snapshots that bypass fresh package-manager resolution. When a user runs pnpm, it installs and executes attacker-selected code during automatic version switching, using the user's privileges.

The vulnerability is fixed by forcing re-resolution of package-manager entries through trusted registries before installation and execution, preventing reuse of repository-controlled lockfile metadata.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows arbitrary code execution with high impact on confidentiality, integrity, and availability. Such a compromise could lead to unauthorized access or manipulation of sensitive data, which may affect compliance with standards like GDPR and HIPAA that require protection of personal and health information.

Specifically, if exploited, the vulnerability could enable attackers to execute malicious code with user privileges, potentially leading to data breaches or system compromise that violate regulatory requirements for data security and privacy.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute arbitrary code on your system with your user privileges when you run pnpm. This can lead to full compromise of confidentiality, integrity, and availability of your environment.

• Arbitrary code execution during automatic version switching.
• Installation of attacker-selected pnpm binaries.
• Potential compromise of sensitive data and system stability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately upgrade pnpm to a patched version where the issue is fixed.

• Upgrade pnpm to version 10.34.2 or later, or 11.5.3 or later.
• Avoid using pnpm versions in the vulnerable ranges: versions prior to 10.34.2 and versions between 11.0.0 and 11.5.3.
• Review and validate the pnpm-lock.yaml file to ensure it has not been tampered with by malicious actors.
• Consider regenerating the lockfile from a trusted source or repository.

Useful 0 Not Useful 0