Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file. The merged fix validates both fields, derives one safe filename, and verifies the final destination before writing. This vulnerability is fixed in 11.5.3.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-55700 Path Traversal in pnpm Package Manager Versions 11.3.0 Through 11.5.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-55700
Post summary
The post announces a path traversal vulnerability (CVE‑2026‑55700) affecting pnpm Package Manager versions 11.3.0‑11.5.3, with details available via the provided Vulmon link.
🚨*CVE* CVE-2026-55700 pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A crafte… https://www.cve.org/CVERecord?id=CVE-2026-55700 ----- Traducción: CVE-2026-55700 pnp… http://infoflow.cloud`
Post summary
CVE-2026-55700 discloses a flaw in pnpm’s stage download that could allow manipulation of local file names via registry data, but no exploit, patch, or evidence of active attack is provided.
CVE-2026-55700 pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A crafte… https://www.cve.org/CVERecord?id=CVE-2026-55700
Post summary
The post announces details of CVE-2026-55700, explaining a flaw in pnpm where file names are derived from external input, but it provides no PoC, exploit, or mitigation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pnpm | pnpm | - | node.js | - |