CVE-2026-55487CWE-346CWE-693CWE-829
pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle
High · published June 25, 2026
What it is
pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stripped parenthesized text from git, URL, tarball, file, and other opaque locators. Approval for one source string could therefore authorize a different attacker-controlled source whose locator normalized to the same value. This vulnerability is fixed in 10.34.2 and 11.5.3.
The record
Technical detail
- CVSS v3.1
- 7.5 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00181 · 7.3th percentile
- Weaknesses
- CWE-346 · Origin Validation Error; CWE-693 · Protection Mechanism Failure; CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
- Published
- 2026-06-25T16:41Z
EPSS history
Timeline