Cyber Resilience

CVE-2026-55698

HighPublic PoC

Published: 25 June 2026

Published
25 June 2026
Modified
30 June 2026
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0019 9.2th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-55698 is a high-severity Insufficient Verification of Data Authenticity (CWE-345) vulnerability in Pnpm Pnpm. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Compromise Software Dependencies and Development Tools (T1195.001); ranked at the 9.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pnpm-lock.yaml. Before the patch, direct pnpm execution trusted an already resolved packageManagerDependencies entry when the committed env lockfile…

more

contained matching pnpm and @pnpm/exe versions. A malicious repository could therefore commit package-manager lockfile package records and snapshots that bypassed fresh package-manager resolution, then cause pnpm to install and execute bytes selected by that committed lockfile state during automatic version switching. This vulnerability is fixed in 10.34.2 and 11.5.3.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1195.001 Compromise Software Dependencies and Development Tools Initial Access
Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise.
T1195.002 Compromise Software Supply Chain Initial Access
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise.
Why these techniques?

Vulnerability enables supply-chain attacks via malicious lockfile bootstrap metadata that bypasses resolution and executes attacker-controlled package-manager binaries.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

pnpm
pnpm
≤ 10.34.2 · 11.0.0 — 11.5.3

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

Provenance documentation and monitoring directly enables verification of authenticity for components and data throughout their history.

addresses: CWE-829 CWE-494

Enforcing installation policies prevents users from including functionality obtained from untrusted control spheres.

addresses: CWE-829 CWE-494

Strategy mandates assessment of third-party components and suppliers, directly reducing inclusion of functionality from untrusted control spheres.

addresses: CWE-494 CWE-829

Supply chain protection requires integrity verification of acquired components, directly reducing insertion or tampering of malicious code during delivery.

addresses: CWE-829 CWE-494

Limits inclusion of functionality from untrusted sources through supply-chain and component trustworthiness evaluation before integration.

addresses: CWE-494 CWE-829

Component authenticity requires verifying origin/integrity of acquired firmware or software, directly preventing inclusion of code without integrity checks.

addresses: CWE-829 CWE-494

Allocation of supply-chain risk management responsibilities and vetting of the development/operational environment reduce inclusion of functionality from untrusted control spheres.

addresses: CWE-494 CWE-829

Authorizing and controlling mobile code requires verifying origin and integrity before download/execution, directly preventing this weakness.

References