Is CVE-2026-59196 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59196 being exploited in the wild.

How severe is CVE-2026-59196?

High severity, with a CVSS score of 7.1, published 6 July 2026.

Which products and versions are affected?

pnpm (npm) SEMVER:introduced=0,fixed=10.34.4.

Is there a fix for CVE-2026-59196?

Yes. pnpm (npm): upgrade to 10.34.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59196 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59196?

Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59196: pnpm path traversal via crafted lockfile alias

CVE-2026-59196 · Severity: high · CVSS 7.1 · Published 2026-07-06

pnpm is a popular tool used by developers to manage and install software building blocks (packages). A security flaw allows a specially crafted configuration file to trick the tool into placing files outside of their intended folders or overwriting critical internal files. If a developer uses a malicious configuration file, it could lead to unauthorized file modifications on their system or disrupt the software build process.

Technologies: pnpm (npm). Vendors: npm.

Quick answers

Is CVE-2026-59196 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59196 being exploited in the wild.
How severe is CVE-2026-59196?: High severity, with a CVSS score of 7.1, published 6 July 2026.
Which products and versions are affected?: pnpm (npm) SEMVER:introduced=0,fixed=10.34.4.
Is there a fix for CVE-2026-59196?: Yes. pnpm (npm): upgrade to 10.34.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59196 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59196?: Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pnpm (npm): upgrade to 10.34.4 or later
```
npm install pnpm@10.34.4
```

Technical details

A path traversal and external control of file path vulnerability (CWE-22, CWE-73) exists in pnpm's hoisted dependency installation logic. The root cause is a failure to validate package-name semantics and path containment before performing filesystem operations or graph insertion. An attacker can craft a malicious lockfile with specific aliases that use traversal sequences to escape the 'node_modules' directory or use reserved names (like '.bin') to overwrite internal pnpm structures. Exploitation requires a user to run pnpm commands against a malicious lockfile. The fix introduces a safe join helper that rejects absolute, platform-specific, and reserved package names.

Affected products

pnpm pnpm < 10.34.4, >= 11.0.0 < 11.7.0

Identifiers

CVE-2026-59196
GHSA-fr4h-3cph-29xv

Timeline

2026-06-22: advisory: GitHub advisory published by maintainers
2026-07-06: disclosed: NVD publication date

References

https://github.com/pnpm/pnpm/security/advisories/GHSA-fr4h-3cph-29xv

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.