pnpm is a package manager

pnpm reads the bin field of installed packages to register command-line shims under PNPM_HOME. The manifest validator on versions <10.34.2 and 11.0.0–11.5.2 fails to reject relative path segments (..) inside scoped bin keys. When the package is later uninstalled or upgraded, pnpm joins the unsanitized bin name to the global bin directory and hands the resulting path to fs.rmSync(..., {recursive: true, force: true}) — recursively deleting whatever the traversal points at. The classic payload is a published package whose bin map contains an entry like @attacker/.., which on cleanup resolves to and obliterates the parent of PNPM_HOME (commonly ~/.local/share/pnpm or the user's home tree).

The vendor 6.5/MEDIUM rating matches reality. The CIA triangle is genuinely A-only — no code execution, no data confidentiality loss, no integrity tampering of in-place files (just destruction). The required UI:R is heavy: a developer or CI job must voluntarily pnpm add -g an attacker-published package, then later run pnpm remove -g or an upgrade that triggers cleanup. That's a typosquat / dependency-confusion social-engineering pre-req, which limits realistic exposure to dev workstations and CI runners that pull global packages from npm. Vendor severity stands.

Why this verdict

• Friction — user interaction required twice: the victim must both install AND later uninstall/update a poisoned package. UI:R plus an out-of-band cleanup trigger is two compounding human steps; most installed-and-forgotten globals never detonate.
• Friction — narrow attack population: only pnpm users (~15% of JS package-manager mindshare per npm telemetry) who use global installs are reachable. Project-local pnpm install does not touch PNPM_HOME and is unaffected.
• Friction — delivery via public npm only: orgs using private registries (Artifactory, Verdaccio, JFrog) with allowlists block the typosquat vector entirely.
• Impact ceiling — availability only: C:N/I:N/A:H. No RCE, no token theft, no persistence. Worst case is wiped ~/.local/share on a dev workstation, recoverable from backup.
• Role multiplier — developer workstations / dev sandboxes: chain succeeds, but blast radius is per-user home directory destruction. Not a fleet-scale outcome. Floor stays MEDIUM.
• Role multiplier — CI build agents: chain succeeds if the agent runs pnpm add -g outside an ephemeral container, but most modern CI is container-per-job; persistent agents that pull global deps are an outlier (<5% per common CI patterns). Blast radius is loss of agent state, not pivot or supply-chain compromise — chain does not poison build artifacts.
• Role multiplier — no canonical high-value-role deployment: pnpm is not a hypervisor, IdP, CA, PAM, backup, kernel-mode agent, or network edge. The HIGH/CRITICAL floor rule does not engage.

Why not higher?

No code execution, no credential theft, no integrity compromise — vector ends in directory deletion. Exploitation requires a victim to choose an attacker's package AND later trigger cleanup, which is a double-gated social engineering chain. EPSS sits at 0.27% with no in-the-wild activity and no KEV listing.

Why not lower?

Fix is trivially available and the destructive payload is real — a successful detonation can wipe a developer's home tree or a long-lived CI agent's state, which is meaningful operational pain. CWE-22 with A:H and AV:N is correctly above LOW. Treating this as IGNORE would leave CI fleets that don't refresh their pnpm binary stuck on a defective release.

1. Upgrade pnpm to 10.34.2 or 11.5.3 — The clean fix. Bump packageManager field in package.json, refresh Corepack pins (corepack prepare [email protected] --activate), and rebuild golden CI images. No mitigation SLA applies to MEDIUM under noisgate — go straight to the 365-day remediation window, but for a one-line version bump there's no reason to wait.
2. Pin npm registry to an internal proxy with allowlist — Artifactory / Verdaccio / Sonatype Nexus in front of the public registry blocks the typosquat vector for this AND future supply-chain bugs. Allowlist by package name + maintainer signature. Roll out across all dev and CI environments.
3. Ban pnpm add -g in CI pipelines — CI runners should never add -g — all dependencies belong in the project's package.json. Add a lint check or pre-commit hook that fails on -g flags in pipeline YAML. Forces project-local installs which are not in the vulnerable code path.
4. Enable Socket.dev / Snyk supply-chain scanning on new packages — Both flag suspicious bin entries with .. segments and unusual scope patterns. Catches the next variant of this bug before it ships.
5. Snapshot dev-workstation home directories nightly — Cheap insurance against this and any other destructive supply-chain payload. Most enterprise endpoint-backup products (Code42, Druva) cover ~/.local/share and dotfile trees by default.

Run on each developer workstation or CI runner that may have pnpm installed. Example: bash check-pnpm-55699.sh. No special privileges required — runs as the invoking user against the pnpm binary on $PATH.

#!/usr/bin/env bash
# noisgate verifier — CVE-2026-55699 (pnpm path traversal via bin field)
# Exits 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -u

if ! command -v pnpm >/dev/null 2>&1; then
  echo "UNKNOWN: pnpm not installed on this host"
  exit 2
fi

raw=$(pnpm --version 2>/dev/null || true)
if [[ -z "$raw" ]]; then
  echo "UNKNOWN: pnpm --version returned nothing"
  exit 2
fi

# Strip any pre-release suffix (e.g. 11.5.3-rc.1 -> 11.5.3)
ver=${raw%%-*}
IFS='.' read -r major minor patch <<<"$ver"

if ! [[ "$major" =~ ^[0-9]+$ && "$minor" =~ ^[0-9]+$ && "$patch" =~ ^[0-9]+$ ]]; then
  echo "UNKNOWN: could not parse pnpm version '$raw'"
  exit 2
fi

vuln=0
if (( major < 10 )); then
  vuln=1
elif (( major == 10 )); then
  if (( minor < 34 )) || { (( minor == 34 )) && (( patch < 2 )); }; then
    vuln=1
  fi
elif (( major == 11 )); then
  if (( minor < 5 )) || { (( minor == 5 )) && (( patch < 3 )); }; then
    vuln=1
  fi
fi

if (( vuln == 1 )); then
  echo "VULNERABLE: pnpm $raw is affected by CVE-2026-55699 — upgrade to 10.34.2 or 11.5.3"
  exit 1
fi

echo "PATCHED: pnpm $raw is not affected by CVE-2026-55699"
exit 0

Sources

1. GitHub Security Advisory GHSA-4gxm-v5v7-fqc4
2. CVEReports — CVE-2026-55699
3. DailyCVE — pnpm Path Traversal via Reserved Bin Names
4. pnpm release notes
5. NVD — CVE-2026-55699
6. FIRST EPSS lookup
7. CISA KEV catalog
8. TheHackerWire — pnpm vulnerability index