Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-25T16:42:08 pnpm: pnpm: Arbitrary code execution via improper handling of config dependencies 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CWE-349

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command dispatch. Before the patch, a repository could declare pacquet or @pnpm/pacquet as a config dependency and pnpm treated that repository-controlled dependency as an install-engine opt-in. During install, pnpm resolved a platform-specific @pacquet/<platform>-<arch>/pacquet binary from node_modules/.pnpm-config/<packageName> and spawned it as the developer or CI user. This vulnerability is fixed in 10.34.2 and 11.5.3.

A flaw was found in pnpm, a package manager. A remote attacker could exploit this vulnerability by crafting a malicious repository that declares a configDependency in its pnpm-workspace.yaml file. When a user installs packages from this repository, pnpm improperly treats the declared dependency as an install-engine opt-in, leading to the execution of a malicious binary. This allows for arbitrary code execution on the system of the developer or continuous integration (CI) user.

This is an Important arbitrary code execution flaw in pnpm, a package manager. A remote attacker could exploit this by crafting a malicious repository that, when used by a developer or CI system, leads to the execution of a malicious binary. This vulnerability arises from pnpm's improper handling of `configDependencies` declared in `pnpm-workspace.yaml`, allowing an untrusted repository to opt into a native install engine. Red Hat AMQ Broker 7 Not affected pnpm Red Hat Build of Keycloak Affected pnpm Red Hat JBoss Enterprise Application Platform 8 Not affected pnpm Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected pnpm https://www.cve.org/CVERecord?id=CVE-2026-55697 https://nvd.nist.gov/vuln/detail/CVE-2026-55697 https://github.com/pnpm/pnpm/security/advisories/GHSA-gj8w-mvpf-x27x