Executive brief
pnpm is a package manager used to install and manage project dependencies. When installing packages from local files or git repositories, pnpm follows symlinks without validating whether they point outside the package directory, allowing malicious packages to leak sensitive local files like SSH keys or AWS credentials into the project.
Technical details
The vulnerability is a symlink traversal (CWE-22, CWE-59) in the addFilesFromDir.ts module. The code uses fs.statSync() and fs.readFileSync() to process package contents, both of which follow symlinks by default, without checking whether the resolved path stays within the package root directory. An attacker can craft a malicious file: or git: dependency containing a symlink pointing to an absolute path (e.g., /etc/passwd or ~/.ssh/id_rsa), causing pnpm to copy the symlink target's contents into node_modules. The attack only requires the victim to install the dependency; registry packages (npm) are not affected because symlinks are stripped during publish. The fix involves using lstatSync to detect symlinks and rejecting those that resolve outside the package root.
Affected products
- pnpm pnpm < 10.28.2
Timeline
- 2026-01-26: disclosed
- 2026-01-26: patched: Fixed in pnpm 10.28.2