Listen to this Post
How CVE-2026-55700 Works
pnpm is a fast, disk-space-efficient package manager for Node.js. The `pnpm stage download` command is used to download a tarball for a specific package version into a staging area, typically as part of a release or build process.
Prior to version 11.5.3, this command derived the local filename to be written directly from registry-controlled fields in the package manifest: the package `name` and the version. A malicious actor could craft a package manifest where the `name` or `version` field contained path traversal sequences (e.g., ../).
When the `pnpm stage download` command processed such a manifest, it would construct an unsafe file path using these unvalidated fields. The command would then attempt to write the downloaded tarball content to this derived path, effectively allowing the attacker to escape the intended download directory and overwrite any other file on the filesystem that the process had permissions to modify.
The vulnerability was patched by implementing multiple layers of defense:
1. Input Validation: The `safeTarballFilename.ts` module now validates both the package name and version, rejecting any that contain cross-platform path separators (/ or \).
2. Safe Filename Derivation: A single, safe filename is derived from the validated inputs, eliminating any possibility of path traversal.
3. Destination Verification: Before any write operation, the `download.ts` module verifies that the resolved absolute output path is an immediate child of the selected download directory.
With the fix in place, any attempt to use a malicious package name or version results in a clear error: `ERR_PNPM_INVALID_PACKAGE_NAME` or ERR_PNPM_INVALID_PACKAGE_VERSION.
DailyCVE Form:
Platform: ……. pnpm
Version: …….. 11.3.0 to 11.5.3
Vulnerability :…… Path Traversal (CWE-22)
Severity: ……. HIGH (CVSS 7.1)
date: ………. 2026-06-25
Prediction: ….. 2026-06-25 (Fixed in 11.5.3)
What Undercode Say:
The fix for this vulnerability was implemented in pull request 12303 and merged as commit 65443f4.
Key Files Changed:
– `releasing/commands/src/tarball/safeTarballFilename.ts`
– `releasing/commands/src/stage/download.ts`
– `releasing/commands/src/tarball/summarizeTarball.ts`
– `releasing/commands/test/stage.test.ts`
Validation Commands:
Check for whitespace errors in the patch $ git diff --check 65443f4bdf^ 65443f4bdf PASS Verify the PR was merged $ gh pr view 12303 --repo pnpm/pnpm --json state,mergeCommit,statusCheckRollup MERGED as 65443f4bdf
All CI checks (compile, lint, dependency audit, Linux Node.js 22/24/26, CodeQL, zizmor) passed on the merged PR.
Exploit:
A malicious actor could create a package with a manifest containing a traversal payload in the `name` or `version` field.
Example vulnerable manifest:
{
"name": "malicious",
"version": "../../../etc/passwd"
}
When processed by a vulnerable `pnpm stage download` command, this would attempt to write the tarball content to /etc/passwd, overwriting the system’s password file.
Protection:
To protect against this vulnerability:
- Update pnpm: The most effective protection is to upgrade to pnpm version `11.5.3` or later, which contains the fix.
- Avoid Untrusted Manifests: Do not use `pnpm stage download` with package manifests from untrusted or unknown sources.
- Principle of Least Privilege: Run build and staging processes with the minimum filesystem permissions necessary, limiting the potential impact of a successful exploit.
Impact:
- Confidentiality: None. The vulnerability allows file overwriting, not reading.
- Integrity: High. An attacker could overwrite critical files, leading to system compromise, arbitrary code execution, or denial of service.
- Availability: Low. Overwriting system files could lead to system instability or crashes.
- Scope: Unchanged. The vulnerable component and the impacted resource are the same.
- User Interaction: Required. The attacker must trick a user or system into processing a malicious manifest.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
