CVE-2026-55698 - pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes
CVE ID :CVE-2026-55698 Published : June 25, 2026, 4:43 p.m. | 4 hours, 27 minutes ago Description :pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pnpm-lock.yaml. Before the patch, direct pnpm execution...