CVE-2026-55697

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command dispatch. Before the patch, a repository could declare pacquet or @pnpm/pacquet as a config dependency and pnpm treated that repository-controlled dependency as an install-engine opt-in. During install, pnpm resolved a platform-specific @pacquet/<platform>-<arch>/pacquet binary from node_modules/.pnpm-config/<packageName> and spawned it as the developer or CI user. This vulnerability is fixed in 10.34.2 and 11.5.3.

• CWE-78
• CWE-494
• CWE-829

• https://github.com/pnpm/pnpm/security/advisories/GHSA-gj8w-mvpf-x27xExploit, Vendor Advisory
• https://github.com/pnpm/pnpm/security/advisories/GHSA-gj8w-mvpf-x27xExploit, Vendor Advisory

Published

Jun 25, 2026

Last Modified

Jun 30, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55686Podman is a tool for managing OCI containers and pods. From …5.3
• CVE-2026-55687ESF-IDF is the Espressif Internet of Things (IOT) Developmen…7.5
• CVE-2026-55688The AsyncHttpClient (AHC) library allows Java applications t…4
• CVE-2026-55689OpenFGA is an authorization/permission engine built for deve…8.1
• CVE-2026-5569A vulnerability was found in Technostrobe HI-LED-WR120-G2 5.…9.8
• CVE-2026-55693Vim is an open source, command line text editor. Prior to 9.…7.8
• CVE-2026-55698pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm…8.8
• CVE-2026-55699pnpm is a package manager. Prior to 10.34.2 and 11.5.3, Mani…6.5
• CVE-2026-5570A vulnerability was determined in Technostrobe HI-LED-WR120-…9.8
• CVE-2026-55700pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm s…7.1
• CVE-2026-55706sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 07…8.3
• CVE-2026-55707In OpenStack Neutron before 28.0.2, the subnetpool onboardin…7.1