Vulnerability-Lookup

brew-pnpm-cve-2026-55700

Vulnerability from osv_homebrew

Published

2026-08-13 17:28

Modified

2026-09-16 10:03

Summary

pnpm: stage download writes outside destination via manifest version traversal

Details

pnpm is a package manager. From 11.3.0 until 11.5.3, pnpm stage download derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file. The merged fix validates both fields, derives one safe filename, and verifies the final destination before writing. This vulnerability is fixed in 11.5.3.

Severity

7.1 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

References

URL

Type

	https://github.com/CVEProject/cvelistV5/tree/main…	ADVISORY
	https://github.com/pnpm/pnpm/security/advisories/…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-55700	ADVISORY
	https://github.com/pnpm/pnpm/pull/12303	FIX

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "11.5.3"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "pnpm",
        "purl": "pkg:brew/pnpm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "11.21.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "git",
    "upstream_evidence": [
      {
        "ecosystem": "GIT",
        "key": "https://github.com/pnpm/pnpm",
        "name": "https://github.com/pnpm/pnpm",
        "strategy": "git",
        "subject_version": "v12.4.2"
      },
      {
        "ecosystem": "npm",
        "key": "pkg:npm/pnpm@12.4.2",
        "name": "pnpm",
        "strategy": "registry",
        "subject_version": "12.4.2"
      }
    ]
  },
  "details": "pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file. The merged fix validates both fields, derives one safe filename, and verifies the final destination before writing. This vulnerability is fixed in 11.5.3.",
  "id": "BREW-pnpm-CVE-2026-55700",
  "modified": "2026-09-16T10:03:26Z",
  "published": "2026-08-13T17:28:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55700.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-v23m-ccfg-pq9h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55700"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pnpm/pnpm/pull/12303"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pnpm: stage download writes outside destination via manifest version traversal",
  "upstream": [
    "GHSA-v23m-ccfg-pq9h",
    "CVE-2026-55700"
  ]
}

CVE-2026-55700 (GCVE-0-2026-55700)

Vulnerability from cvelistv5 – Published: 2026-06-25 16:47 – Updated: 2026-06-25 18:16

Title

pnpm: stage download writes outside destination via manifest version traversal

Summary

pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file. The merged fix validates both fields, derives one safe filename, and verifies the final destination before writing. This vulnerability is fixed in 11.5.3.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-25 18:16 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73 - External Control of File Name or Path

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/pnpm/pnpm/security/advisories/…	x_refsource_CONFIRM
https://github.com/pnpm/pnpm/pull/12303	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
pnpm	pnpm	Affected: >= 11.3.0, < 11.5.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55700",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-25T18:16:18.487487Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-25T18:16:35.788Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pnpm",
          "vendor": "pnpm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 11.3.0, \u003c 11.5.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file. The merged fix validates both fields, derives one safe filename, and verifies the final destination before writing. This vulnerability is fixed in 11.5.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T16:47:21.488Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pnpm/pnpm/security/advisories/GHSA-v23m-ccfg-pq9h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-v23m-ccfg-pq9h"
        },
        {
          "name": "https://github.com/pnpm/pnpm/pull/12303",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pnpm/pnpm/pull/12303"
        }
      ],
      "source": {
        "advisory": "GHSA-v23m-ccfg-pq9h",
        "discovery": "UNKNOWN"
      },
      "title": "pnpm: stage download writes outside destination via manifest version traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55700",
    "datePublished": "2026-06-25T16:47:21.488Z",
    "dateReserved": "2026-06-17T00:13:10.651Z",
    "dateUpdated": "2026-06-25T18:16:35.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-V23M-CCFG-PQ9H

Vulnerability from github – Published: 2026-06-26 23:54 – Updated: 2026-06-26 23:54

Summary

pnpm: `stage download` writes outside its destination directory via manifest name/version traversal

Details

Summary

The staged-tarball filename traversal reported as GHSA-v23m-ccfg-pq9h / CAND-PNPM-038 is fixed on main by pnpm/pnpm#12303, merged as 65443f4bdf1f0db9c8c7dc58fee25252607e9234.

Before the fix, pnpm stage download derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file. The merged fix validates both fields, derives one safe filename, and verifies the final destination before writing.

Security boundary

Package names and semantic versions are validated before they can influence a local filename.
POSIX and Windows path separators are rejected by basename checks.
Stage download and tarball summary paths use the same filename helper.
The resolved output path must remain an immediate child of the selected download directory.
The stage identifier is already constrained to a UUID.

Exploit replay

Before 65443f4bdf, a traversal-bearing manifest version could make the command write outside the selected directory. After the fix, malicious package names fail with ERR_PNPM_INVALID_PACKAGE_NAME, malicious versions fail with ERR_PNPM_INVALID_PACKAGE_VERSION, no outside file is created, and the download directory remains empty.

Files changed

releasing/commands/src/tarball/safeTarballFilename.ts validates manifest identity and rejects cross-platform path separators.
releasing/commands/src/stage/download.ts verifies the resolved destination before writing.
releasing/commands/src/tarball/summarizeTarball.ts uses the same filename contract.
releasing/commands/test/stage.test.ts covers traversal through both package name and version.
.changeset/stale-stage-tarballs.md includes patch bumps for @pnpm/releasing.commands and pnpm.

Patch

Merged PR: https://github.com/pnpm/pnpm/pull/12303
Fix commit: 65443f4bdf1f0db9c8c7dc58fee25252607e9234
The private candidate branch was not submitted because it conflicts with and is superseded by the merged fix. The upstream patch is slightly stronger because it covers malicious package names as well as versions.

Commands run

$ git diff --check 65443f4bdf^ 65443f4bdf
PASS
$ gh pr view 12303 --repo pnpm/pnpm --json state,mergeCommit,statusCheckRollup
MERGED as 65443f4bdf

Validation

Upstream regression coverage rejects traversal through both manifest name and version and verifies that no outside file is created.
Compile and lint, dependency audit, Linux Node.js 22/24/26, CodeQL, and zizmor checks passed on the merged public PR.
The Windows Node.js 22 full-suite job timed out in the unrelated pnpm/test/dlx.ts cache test after 512 other tests passed. The PR was merged by the maintainer; the failure did not involve the staging code.
The earlier private candidate's focused exploit regression, positive control, package compile, ESLint, and git diff --check also passed.

Compatibility

Staging and release commands are TypeScript-only. Pacquet does not expose this command family, so no Rust-side port is required.

Remaining risk

The final fs.writeFile follows a pre-existing symlink at the exact in-directory output name. That requires separate local filesystem access and is not controllable through the registry manifest traversal described here.

Written by an agent (Codex, GPT-5).

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "pnpm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.3.0"
            },
            {
              "fixed": "11.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55700"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-26T23:54:52Z",
    "nvd_published_at": "2026-06-25T18:16:41Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe staged-tarball filename traversal reported as GHSA-v23m-ccfg-pq9h / CAND-PNPM-038 is fixed on `main` by [pnpm/pnpm#12303](https://github.com/pnpm/pnpm/pull/12303), merged as `65443f4bdf1f0db9c8c7dc58fee25252607e9234`.\n\nBefore the fix, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file. The merged fix validates both fields, derives one safe filename, and verifies the final destination before writing.\n\n## Security boundary\n\n- Package names and semantic versions are validated before they can influence a local filename.\n- POSIX and Windows path separators are rejected by basename checks.\n- Stage download and tarball summary paths use the same filename helper.\n- The resolved output path must remain an immediate child of the selected download directory.\n- The stage identifier is already constrained to a UUID.\n\n## Exploit replay\n\nBefore `65443f4bdf`, a traversal-bearing manifest version could make the command write outside the selected directory. After the fix, malicious package names fail with `ERR_PNPM_INVALID_PACKAGE_NAME`, malicious versions fail with `ERR_PNPM_INVALID_PACKAGE_VERSION`, no outside file is created, and the download directory remains empty.\n\n## Files changed\n\n- `releasing/commands/src/tarball/safeTarballFilename.ts` validates manifest identity and rejects cross-platform path separators.\n- `releasing/commands/src/stage/download.ts` verifies the resolved destination before writing.\n- `releasing/commands/src/tarball/summarizeTarball.ts` uses the same filename contract.\n- `releasing/commands/test/stage.test.ts` covers traversal through both package name and version.\n- `.changeset/stale-stage-tarballs.md` includes patch bumps for `@pnpm/releasing.commands` and `pnpm`.\n\n## Patch\n\n- Merged PR: https://github.com/pnpm/pnpm/pull/12303\n- Fix commit: `65443f4bdf1f0db9c8c7dc58fee25252607e9234`\n- The private candidate branch was not submitted because it conflicts with and is superseded by the merged fix. The upstream patch is slightly stronger because it covers malicious package names as well as versions.\n\n## Commands run\n\n```text\n$ git diff --check 65443f4bdf^ 65443f4bdf\nPASS\n$ gh pr view 12303 --repo pnpm/pnpm --json state,mergeCommit,statusCheckRollup\nMERGED as 65443f4bdf\n```\n\n## Validation\n\n- Upstream regression coverage rejects traversal through both manifest name and version and verifies that no outside file is created.\n- Compile and lint, dependency audit, Linux Node.js 22/24/26, CodeQL, and zizmor checks passed on the merged public PR.\n- The Windows Node.js 22 full-suite job timed out in the unrelated `pnpm/test/dlx.ts` cache test after 512 other tests passed. The PR was merged by the maintainer; the failure did not involve the staging code.\n- The earlier private candidate\u0027s focused exploit regression, positive control, package compile, ESLint, and `git diff --check` also passed.\n\n## Compatibility\n\nStaging and release commands are TypeScript-only. Pacquet does not expose this command family, so no Rust-side port is required.\n\n## Remaining risk\n\nThe final `fs.writeFile` follows a pre-existing symlink at the exact in-directory output name. That requires separate local filesystem access and is not controllable through the registry manifest traversal described here.\n\n---\nWritten by an agent (Codex, GPT-5).",
  "id": "GHSA-v23m-ccfg-pq9h",
  "modified": "2026-06-26T23:54:52Z",
  "published": "2026-06-26T23:54:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-v23m-ccfg-pq9h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55700"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pnpm/pnpm/pull/12303"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pnpm/pnpm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pnpm: `stage download`\u00a0writes outside its destination directory via manifest name/version traversal"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

brew-pnpm-cve-2026-55700

Vulnerability from osv_homebrew

CVE-2026-55700 (GCVE-0-2026-55700)

GHSA-V23M-CCFG-PQ9H

Summary

Security boundary

Exploit replay

Files changed

Patch

Commands run

Validation

Compatibility

Remaining risk

Tags

Sightings

Nomenclature

Related by attack behaviour