Executive brief
pnpm is a Node.js package manager that installs and manages project dependencies. A flaw in pacquet (pnpm's alternative installer) allows a crafted lockfile to create symlinks and directory structures outside the intended project directory when using frozen lockfiles or the --trust-lockfile flag. This could allow a malicious lockfile to escape the project's node_modules boundary and modify files elsewhere on the system.
Technical details
The vulnerability is a path traversal flaw (CWE-22, CWE-59, CWE-73) in pacquet's dependency installation logic. When processing lockfiles with the --trust-lockfile flag or frozen lockfiles, the package manager failed to validate dependency alias names before creating symlinks, directories, bins, and hoisted entries. An attacker could craft a lockfile with traversal sequences (e.g., "../../escaped-link") as dependency keys to create filesystem structures outside the project or node_modules boundary. The patch introduces a shared safe-join helper that validates all dependency names and virtual-store slots before any filesystem materialization, rejecting traversal patterns, absolute paths, and reserved names. The fix applies to direct/transitive links, package links, bin destinations, and hoist destinations, with validation occurring before store initialization to prevent warm-install bypasses.
Affected products
- pnpm pnpm >= 12.0.0-alpha.0, < 12.0.0-alpha.5
Timeline
- 2026-08-02: disclosed: Vulnerability reported to pnpm security advisory
- 2026-09-01: patched: Patch released in version 12.0.0-alpha.5