Quick answers
- Is CVE-2026-24056 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-24056 being exploited in the wild.
- How severe is CVE-2026-24056?
- Low severity, with a CVSS score of 3.1, published 26 January 2026.
- Which products and versions are affected?
- pnpm (npm) SEMVER:introduced=0,fixed=10.28.2.
- Is there a fix for CVE-2026-24056?
- Yes. pnpm (npm): upgrade to 10.28.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-24056 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-24056?
- Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- pnpm (npm): upgrade to 10.28.2 or later
npm install pnpm@10.28.2
Technical details
The vulnerability is a symlink traversal (CWE-22, CWE-59) in the addFilesFromDir.ts module. The code uses fs.statSync() and fs.readFileSync() to process package contents, both of which follow symlinks by default, without checking whether the resolved path stays within the package root directory. An attacker can craft a malicious file: or git: dependency containing a symlink pointing to an absolute path (e.g., /etc/passwd or ~/.ssh/id_rsa), causing pnpm to copy the symlink target's contents into node_modules. The attack only requires the victim to install the dependency; registry packages (npm) are not affected because symlinks are stripped during publish. The fix involves using lstatSync to detect symlinks and rejecting those that resolve outside the package root.
Affected products
- pnpm pnpm < 10.28.2
Identifiers
- CVE-2026-24056
- GHSA-m733-5w8f-5ggw
Timeline
- 2026-01-26: disclosed
- 2026-01-26: patched: Fixed in pnpm 10.28.2