Executive brief
pnpm is a popular Node.js package manager that uses lockfiles to manage project dependencies. A vulnerability in pnpm's pacquet component allows a malicious lockfile to create symbolic links that escape the project directory, potentially allowing an attacker to write files to arbitrary locations on the system when the lockfile is installed with trust enabled. This could lead to arbitrary code execution or system compromise.
Technical details
The vulnerability is a path traversal (CWE-22) and improper link resolution (CWE-59) issue in pacquet's install logic. When processing a crafted lockfile with dependency aliases containing traversal segments (e.g., `../../escaped-link`), the package manager could create symbolic links outside the project boundary without proper validation. The vulnerability affects both direct dependency links and global virtual-store slots, and can be exploited even when --trust-lockfile or frozen lockfiles are used. The fix adds a shared safe_join_modules_dir helper that validates all dependency names, virtual-store paths, and link destinations before filesystem materialization, rejecting absolute paths, reserved names, and traversal sequences. The patch was released in pnpm 12.0.0-alpha.5 and applied across install, symlink, bin, hoist, and virtual-store code paths.
Affected products
- pnpm pnpm >=12.0.0-alpha.0, <12.0.0-alpha.5
Timeline
- 2026-09-01: disclosed: GHSA-2rx9-3g3h-c2jv published
- 2026-09-01: patched: Fix released in pnpm 12.0.0-alpha.5