CVE-2026-55698
Published: 25 June 2026
Summary
CVE-2026-55698 is a high-severity Insufficient Verification of Data Authenticity (CWE-345) vulnerability in Pnpm Pnpm. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Compromise Software Dependencies and Development Tools (T1195.001); ranked at the 9.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-39484
Vulnerability details
pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pnpm-lock.yaml. Before the patch, direct pnpm execution trusted an already resolved packageManagerDependencies entry when the committed env lockfile…
more
contained matching pnpm and @pnpm/exe versions. A malicious repository could therefore commit package-manager lockfile package records and snapshots that bypassed fresh package-manager resolution, then cause pnpm to install and execute bytes selected by that committed lockfile state during automatic version switching. This vulnerability is fixed in 10.34.2 and 11.5.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables supply-chain attacks via malicious lockfile bootstrap metadata that bypasses resolution and executes attacker-controlled package-manager binaries.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Provenance documentation and monitoring directly enables verification of authenticity for components and data throughout their history.
Enforcing installation policies prevents users from including functionality obtained from untrusted control spheres.
Strategy mandates assessment of third-party components and suppliers, directly reducing inclusion of functionality from untrusted control spheres.
Supply chain protection requires integrity verification of acquired components, directly reducing insertion or tampering of malicious code during delivery.
Limits inclusion of functionality from untrusted sources through supply-chain and component trustworthiness evaluation before integration.
Component authenticity requires verifying origin/integrity of acquired firmware or software, directly preventing inclusion of code without integrity checks.
Allocation of supply-chain risk management responsibilities and vetting of the development/operational environment reduce inclusion of functionality from untrusted control spheres.
Authorizing and controlling mobile code requires verifying origin and integrity before download/execution, directly preventing this weakness.