CVE-2026-59196: Pnpm Path Traversal Vulnerability

CVE-2026-59196 Overview

CVE-2026-59196 is a path traversal vulnerability [CWE-22] in pnpm, a JavaScript package manager widely used as an alternative to npm and yarn. Versions prior to 10.34.4 and 11.7.0 join crafted lockfile aliases directly under the hoisted node_modules directory without adequate sanitization. Attackers can construct traversal aliases that escape the intended directory, or use reserved aliases such as .bin or .pnpm to overwrite pnpm-owned layout. The issue is resolved in pnpm10.34.4 and 11.7.0.

Critical Impact
A malicious lockfile can write files outside node_modules or overwrite pnpm-managed paths, enabling integrity compromise of developer and CI/CD environments.

Affected Products

pnpm versions prior to 10.34.4 (10.x branch)
pnpm versions prior to 11.7.0 (11.x branch)
Node.js projects consuming untrusted pnpm-lock.yaml files

Discovery Timeline

2026-07-06 - CVE-2026-59196 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-59196

Vulnerability Analysis

The vulnerability resides in how pnpm resolves and materializes packages listed in pnpm-lock.yaml under a hoisted node_modules layout. When an alias entry from the lockfile is processed, pnpm joins the alias string directly to the target node_modules path. The join operation trusts the alias as a safe path component. If the alias contains traversal sequences such as ../, the resulting path escapes node_modules entirely. If the alias matches reserved directory names like .bin or .pnpm, pnpm overwrites its own internal layout used to link binaries and virtual store entries.

The attack requires user interaction because a developer or CI job must execute pnpm install against the crafted lockfile. Successful exploitation compromises integrity of arbitrary filesystem locations writable by the pnpm process and can subvert the binary shim mechanism that resolves executables from node_modules/.bin.

Root Cause

The root cause is missing validation of alias strings sourced from the lockfile before they are used as path segments. Aliases are attacker-controllable input in any workflow that installs dependencies from a repository, fork, or artifact of untrusted origin. The code path lacked both traversal detection (rejecting .. and absolute segments) and a reserved-name allowlist for pnpm-managed directories such as .bin and .pnpm.

Attack Vector

An attacker publishes or submits a repository, pull request, or package containing a crafted pnpm-lock.yaml. When a victim runs pnpm install, the malicious alias is joined under node_modules. Traversal aliases place files at attacker-chosen locations relative to the project. Reserved aliases replace the contents of node_modules/.bin or node_modules/.pnpm, allowing subsequent invocations of project scripts to execute attacker-influenced binaries. See the pnpm GitHub Security Advisory GHSA-fr4h-3cph-29xv for the vendor's technical description.

Detection Methods for CVE-2026-59196

Indicators of Compromise

Entries in pnpm-lock.yaml where alias keys contain .., path separators (/, \), or absolute paths.
Alias keys matching reserved names such as .bin, .pnpm, or other pnpm-managed directories.
Unexpected files appearing outside node_modules after pnpm install completes.
Modified or replaced shim scripts inside node_modules/.bin that do not correspond to any declared dependency.

Detection Strategies

Scan repositories and CI artifacts for pnpm-lock.yaml files and grep alias fields for .., /, \, .bin, and .pnpm patterns.
Compare the installed pnpm version reported by pnpm --version against the fixed releases 10.34.4 and 11.7.0 in build agents.
Monitor CI/CD build logs for file writes outside the project workspace during pnpm install phases.

Monitoring Recommendations

Track filesystem write events performed by node and pnpm processes on developer workstations and build runners.
Alert on modifications to node_modules/.bin and node_modules/.pnpm that occur outside of a controlled install step.
Correlate lockfile changes in code review with subsequent anomalous file creation events on the runner that processes the pull request.

How to Mitigate CVE-2026-59196

Immediate Actions Required

Upgrade pnpm to 10.34.4 on the 10.x branch or 11.7.0 on the 11.x branch across developer machines and CI runners.
Audit recent merges and third-party contributions that modified pnpm-lock.yaml for suspicious alias entries.
Rebuild affected node_modules directories from scratch after upgrading to remove any residual attacker-planted files.

Patch Information

The pnpm maintainers released fixes in pnpm10.34.4 and pnpm11.7.0. Both versions validate lockfile aliases and reject traversal sequences and reserved directory names before joining them under node_modules. Full details are available in the pnpm GitHub Security Advisory GHSA-fr4h-3cph-29xv.

Workarounds

Do not run pnpm install against lockfiles from untrusted forks, pull requests, or artifacts until upgrading.
Enforce lockfile review policies that reject alias keys containing .., path separators, or reserved names such as .bin and .pnpm.
Run CI installs in isolated, ephemeral containers with least-privilege filesystem access to constrain the blast radius of any traversal write.

bash

# Verify and upgrade pnpm to a fixed release
pnpm --version

# For the 10.x branch
npm install -g pnpm@10.34.4

# For the 11.x branch
npm install -g pnpm@11.7.0

# Re-verify
pnpm --version