Executive brief
pnpm is a package manager for JavaScript projects. A vulnerability exists where a malicious project can use a specially crafted lockfile to create files (symlinks) outside of the intended project directory when a user runs an installation command. This could allow an attacker to overwrite or manipulate files on a developer's machine or a build server, potentially leading to unauthorized code execution or system compromise.
Technical details
A path traversal vulnerability exists in pnpm's handling of the 'configDependencies' section within the environment lockfile (pnpm-lock.yaml). The application fails to validate package names before using them as path components when creating symlinks under 'node_modules/.pnpm-config'. An attacker can provide a crafted lockfile containing traversal sequences (e.g., '../../') in a dependency name. When a user executes 'pnpm install', the software uses path.join() with the untrusted input, allowing the creation of symlinks at arbitrary locations on the filesystem. This exploit does not require lifecycle scripts to be enabled and occurs early in the installation process. The issue is fixed in versions 10.34.4 and 11.8.0.
Affected products
- pnpm pnpm < 10.34.4, >= 11.0.0 < 11.8.0
Timeline
- 2026-06-22: disclosed
- 2026-06-27: advisory