CVE-2026-101044: pacquet Path Traversal Vulnerability

CVE-2026-101044 Overview

CVE-2026-101044 is a path traversal vulnerability [CWE-22] in pacquet, the Rust package-manager component shipped in the pnpm npm package. Affected versions are >=12.0.0-alpha.0 and <12.0.0-alpha.5. The component does not validate dependency alias or name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied lockfile using --trust-lockfile or a frozen lockfile, alias entries containing traversal segments allow symlinks and directories to be created outside the intended project and node_modules boundary.

Critical Impact
Attacker-controlled lockfiles can create symlinks and directories outside the project boundary, enabling integrity compromise of files beyond node_modules.

Affected Products

pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5
pacquet Rust package-manager component bundled with the above versions
Projects installed with --trust-lockfile or a frozen lockfile from untrusted sources

Discovery Timeline

2026-09-27 - CVE-2026-101044 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-101044

Vulnerability Analysis

The pacquet component resolves dependency alias and name strings read from the lockfile and joins them into filesystem paths without containment checks. These joined paths are used across several install-time operations, including dependency and package link creation, bin destination writes, hoisted entry placement, and virtual-store slot allocation. An alias such as ../../escaped-link is treated as a legitimate name and passed to filesystem APIs that materialize symlinks and directories outside the project root.

The vulnerability triggers only during install when the user opts into trusting the lockfile. The attack surface opens whenever a developer runs pnpm install --trust-lockfile or uses a frozen lockfile against a repository that includes an attacker-crafted pnpm-lock.yaml.

Root Cause

The root cause is missing input validation on dependency names and virtual-store slot paths before filesystem materialization. pacquet trusted lockfile-sourced strings as safe path components and performed path joins without a containment helper to confirm the result stays within the expected project and node_modules boundary.

Attack Vector

An attacker publishes or contributes a malicious pnpm-lock.yaml containing alias entries with traversal segments, absolute paths, platform-specific separators, or reserved names. A victim then clones the repository and runs an install with lockfile trust enabled. During install, pacquet writes symlinks and creates directories at the attacker-chosen locations, achieving arbitrary filesystem writes within the privileges of the install process. User interaction is required because an install command must be executed.

Detection Methods for CVE-2026-101044

Indicators of Compromise

Symlinks or directories created outside the project node_modules tree during or shortly after pnpm install operations
pnpm-lock.yaml entries containing alias or name fields with .., absolute paths, or platform-specific separators
Install logs lacking ERR_PNPM_INVALID_DEPENDENCY_NAME rejections when a known-malicious lockfile is processed
Unexpected files appearing in parent directories of CI workspace roots

Detection Strategies

Scan repositories and CI inputs for pnpm-lock.yaml files containing suspicious alias patterns before install
Audit filesystem write telemetry during package install for paths outside the project root
Enforce version pinning checks that block pnpm builds >=12.0.0-alpha.0 and <12.0.0-alpha.5

Monitoring Recommendations

Monitor developer workstations and build agents for symlink and mkdir syscalls targeting paths outside the project directory during pnpm processes
Alert on CI jobs invoking pnpm install with --trust-lockfile against repositories with recently modified lockfiles
Track installed pnpm versions across engineering fleets through software inventory

How to Mitigate CVE-2026-101044

Immediate Actions Required

Upgrade pnpm to version 12.0.0-alpha.5 or later, which validates dependency names and virtual-store slot paths with a shared safe-join containment helper
Avoid using --trust-lockfile or frozen lockfile installs against repositories or branches from untrusted contributors
Review recent lockfile diffs in shared repositories for alias entries containing traversal segments

Patch Information

Version 12.0.0-alpha.5 validates dependency names and every virtual-store slot path with a shared safe-join containment helper before any filesystem materialization. The fix rejects traversal, absolute, platform-specific, and reserved names with ERR_PNPM_INVALID_DEPENDENCY_NAME. See the GitHub Security Advisory GHSA-2rx9-3g3h-c2jv and the VulnCheck Path Traversal Advisory.

Workarounds

Do not pass --trust-lockfile on any pnpm install invocation until all workloads run patched versions
Require code review on all pnpm-lock.yaml changes and reject entries containing .., absolute paths, or reserved names
Run installs in sandboxed CI environments where write access outside the workspace directory is denied

bash

# Configuration example
# Upgrade pnpm to the fixed version or later
npm install -g pnpm@12.0.0-alpha.5

# Verify installed version
pnpm --version