Executive brief
pnpm is a package manager used by developers to install and manage software dependencies. A vulnerability was found where a specially crafted lockfile could allow files to be installed outside of the intended project directory or overwrite internal configuration files. This could lead to unauthorized file modifications or system instability if a developer is tricked into using a malicious lockfile.
Technical details
A path traversal vulnerability (CWE-22) exists in pnpm's hoisted dependency resolution logic. A crafted lockfile alias can be used to escape the intended 'node_modules' directory or overwrite reserved internal directories like '.bin' or '.pnpm'. The issue stems from insufficient validation of package-name semantics and path containment before performing filesystem operations or graph insertion. Attackers can exploit this by providing a malicious lockfile that a user then processes via pnpm install. The vulnerability has been patched in versions 10.34.4 and 11.7.0 by implementing stricter validation of dependency names and ensuring they remain within the intended directory boundaries.
Affected products
- pnpm pnpm < 10.34.4, >= 11.0.0 < 11.7.0
Timeline
- 2026-06-22: disclosed
- 2026-06-27: advisory