CVE-2026-59195
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
pnpm before versions 10.34.4 and 11.8.0 accepts package names from the configDependencies section of pnpm-lock.yaml and uses them directly when creating config dependency symlinks under node_modules/.pnpm-config. A malicious repository can supply a crafted lock file containing a traversal-shaped config dependency name, leading to symlink creation outside the intended directory.
Risk Assessment
An attacker can exploit this vulnerability to overwrite files outside the project directory, potentially achieving remote code execution or persistent system compromise during dependency installation.
Recommendation
Upgrade pnpm to version 10.34.4 or 11.8.0 immediately. Do not run pnpm install in untrusted repositories before upgrading.
Original NVD description (English source)
pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those names directly when creating config dependency symlinks under node_modules/.pnpm-config. A malicious repository can commit a crafted pnpm-lock.yaml whose env-lockfile document contains a traversal-shaped config dependency name. During pnpm install, pnpm installs the config dependency and creates a symlink at a path derived from that name. This vulnerability is fixed in 10.34.4 and 11.8.0.