Executive brief
pnpm is a popular tool used by developers to manage and install software building blocks (packages). A security flaw allows a specially crafted configuration file to trick the tool into placing files outside of their intended folders or overwriting critical internal files. If a developer uses a malicious configuration file, it could lead to unauthorized file modifications on their system or disrupt the software build process.
Technical details
A path traversal and external control of file path vulnerability (CWE-22, CWE-73) exists in pnpm's hoisted dependency installation logic. The root cause is a failure to validate package-name semantics and path containment before performing filesystem operations or graph insertion. An attacker can craft a malicious lockfile with specific aliases that use traversal sequences to escape the 'node_modules' directory or use reserved names (like '.bin') to overwrite internal pnpm structures. Exploitation requires a user to run pnpm commands against a malicious lockfile. The fix introduces a safe join helper that rejects absolute, platform-specific, and reserved package names.
Affected products
- pnpm pnpm < 10.34.4, >= 11.0.0 < 11.7.0
Timeline
- 2026-06-22: advisory: GitHub advisory published by maintainers
- 2026-07-06: disclosed: NVD publication date