Executive brief
pnpm is a popular JavaScript package manager used to install and manage software dependencies. A security flaw allows a malicious project to create unauthorized symbolic links (shortcuts) on a user's computer when they run the 'pnpm install' command. This could allow an attacker to overwrite or manipulate files outside of the intended project folder, potentially leading to unauthorized system changes or persistent access even if security scripts are disabled.
Technical details
A path traversal vulnerability exists in pnpm's handling of the 'env-lockfile' document within 'pnpm-lock.yaml'. The application fails to validate package names in the 'configDependencies' section before using them as path components in 'path.join()' operations. An attacker can commit a crafted lockfile containing traversal sequences (e.g., '../../') in a dependency name. When a user runs 'pnpm install', the tool creates a symlink from the global virtual store to a location outside the 'node_modules/.pnpm-config' directory. This exploit functions even when '--ignore-scripts' is used, providing a filesystem write primitive. The issue is resolved in versions 10.34.4 and 11.8.0 by implementing stricter name validation and path containment checks.
Affected products
- pnpm pnpm < 10.34.4, >= 11.0.0 < 11.8.0
Timeline
- 2026-06-22: advisory: GitHub Security Advisory published by maintainers
- 2026-07-06: disclosed: CVE published to NVD