Loading vulnerability…
CVE-2026-55700 is a path traversal vulnerability in pnpm's stage download command affecting versions from 11.3.0 through 11.5.2. The vulnerable logic derived a local output filename from registry-controlled name and version fields in a downloaded package manifest and then resolved that path for writing without sufficient validation. Because those metadata fields were not safely constrained, a crafted manifest could include traversal sequences that caused the resolved destination to escape the intended download directory. As a result, pnpm could write the downloaded tarball to an attacker-chosen reachable filesystem path under the privileges of the user or CI/CD process running the command. The fix in 11.5.3 validates package names and semantic versions, derives a single safe filename, and verifies the final destination remains within the selected download directory before writing.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
pnpm stage download against untrusted, third-party, or attacker-controlled registries or manifests. Restrict the filesystem permissions of the account or CI runner executing pnpm so that unintended overwrites have limited blast radius. Prefer isolated build environments and review/customize registry trust settings to reduce exposure to malicious manifest metadata.Patch, then assume compromise.
name and version, derives a safe filename, and enforces path-containment checks on the final resolved destination before writing. If version pinning is used in developer environments or CI pipelines, update those pins to 11.5.3+ and rebuild affected environments.No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.