CVE-2026-59195: Pnpm Path Traversal Vulnerability

CVE-2026-59195 Overview

CVE-2026-59195 is a path traversal vulnerability [CWE-22] in the pnpm JavaScript package manager. The flaw affects pnpm versions prior to 10.34.4 and 11.8.0. The package manager accepts package names from the env-lockfile configDependencies section of pnpm-lock.yaml and uses them directly when creating symlinks under node_modules/.pnpm-config. A malicious repository can commit a crafted lockfile containing traversal sequences in the config dependency name. During pnpm install, the symlink is written to an attacker-controlled path outside the intended directory.

Critical Impact
Cloning and installing a malicious repository can result in arbitrary symlink creation and integrity compromise on the developer host, with CVSS 8.2 (HIGH).

Affected Products

pnpm versions prior to 10.34.4
pnpm versions in the 11.x branch prior to 11.8.0
Node.js projects consuming untrusted pnpm-lock.yaml files

Discovery Timeline

2026-07-06 - CVE-2026-59195 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-59195

Vulnerability Analysis

The vulnerability resides in the config dependency installation logic of pnpm. When resolving configDependencies declared in the env-lockfile section of pnpm-lock.yaml, pnpm uses the raw dependency name as a path segment. The name is concatenated onto the base directory node_modules/.pnpm-config without normalization or containment checks. A crafted name containing ../ sequences escapes the intended directory. The result is a symlink created at an arbitrary filesystem location writable by the invoking user.

Exploitation requires only that a victim run pnpm install on a repository that ships a tampered lockfile. This mirrors the trust model already violated by malicious package.json scripts, but bypasses controls that disable lifecycle scripts because the symlink is written by pnpm itself.

Root Cause

The root cause is missing input validation on the package name field parsed from the env-lockfile document. pnpm treats the value as trusted data rather than attacker-controlled input. No canonicalization is performed before joining the name onto the target directory path.

Attack Vector

The attack vector is network-based with user interaction. An attacker publishes or contributes a repository containing a malicious pnpm-lock.yaml. The victim clones the repository and runs pnpm install. pnpm reads the env-lockfile, iterates configDependencies, and calls its symlink routine using the traversal-shaped name. The symlink lands outside node_modules/.pnpm-config, enabling overwrite of files such as shell startup scripts or CI configuration on subsequent operations.

See the GitHub Security Advisory GHSA-qrv3-253h-g69c for advisory details.

Detection Methods for CVE-2026-59195

Indicators of Compromise

Symlinks appearing outside node_modules/.pnpm-config immediately after a pnpm install run
pnpm-lock.yaml files containing entries under configDependencies with names containing ../, ..\, or absolute path prefixes
Modified dotfiles such as ~/.bashrc, ~/.zshrc, or CI runner configuration files following a dependency install step

Detection Strategies

Scan committed pnpm-lock.yaml files in source control for suspicious characters (.., /, \) inside configDependencies keys
Run pnpm install inside sandboxed containers and inspect filesystem diffs before promoting builds
Enable filesystem audit logging (auditd, EDR file telemetry) on developer workstations and CI runners to capture symlink creation events

Monitoring Recommendations

Alert on symlink creation events where the target path resides outside the project working directory during Node.js build steps
Track pnpm versions across developer endpoints and CI images to confirm patched releases are in use
Review pull requests that modify pnpm-lock.yaml for unexpected configDependencies additions

How to Mitigate CVE-2026-59195

Immediate Actions Required

Upgrade pnpm to 10.34.4 or 11.8.0 or later on all developer workstations, build servers, and container images
Audit repositories that pin older pnpm versions in packageManager fields of package.json
Do not run pnpm install on untrusted repositories using vulnerable versions

Patch Information

The vulnerability is fixed in pnpm10.34.4 and 11.8.0. Patched releases validate config dependency names and prevent traversal sequences from resolving outside node_modules/.pnpm-config. Refer to the pnpm security advisory GHSA-qrv3-253h-g69c for the fix commit reference.

Workarounds

Pin pnpm to a patched version via Corepack or the packageManager field in package.json
Execute installs inside ephemeral containers with read-only bind mounts on sensitive host paths
Review and sanitize configDependencies entries in pnpm-lock.yaml before running pnpm install on third-party code

bash

# Upgrade pnpm to a patched release
npm install -g pnpm@11.8.0

# Or pin via Corepack in package.json
# "packageManager": "pnpm@11.8.0"
corepack use pnpm@11.8.0

# Verify version
pnpm --version