CVE-2026-55699: pnpm: Reserved bin name deletes PNPM_HOME during global remove

June 26, 2026

Manifest bin object keys such as "", ".", and ".." passed pnpm’s bin-name guard. When a malicious package was installed globally, later global remove, update, or add-replacement flows could re-derive those names from the installed manifest and pass path.join(globalBinDir, binName) to removeBin. For "." this targets the global bin directory; for ".." this targets its parent.

References

github.com/advisories/GHSA-4gxm-v5v7-fqc4
github.com/pnpm/pnpm/security/advisories/GHSA-4gxm-v5v7-fqc4
nvd.nist.gov/vuln/detail/CVE-2026-55699

Code Behaviors & Features

Detect and mitigate CVE-2026-55699 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →