CVE-2026-59196
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
In the pnpm package manager prior to versions 10.34.4 and 11.7.0, a crafted lockfile alias could be placed directly under a hoisted node_modules directory. Traversal aliases could escape that directory, while reserved aliases such as .bin or .pnpm could overwrite pnpm-owned layout.
Risk Assessment
An attacker could exploit this vulnerability to overwrite files or access sensitive locations in the filesystem, potentially leading to privilege escalation or arbitrary code execution.
Recommendation
It is recommended to immediately upgrade pnpm to version 10.34.4 or 11.7.0, which contain a fix for this vulnerability.
Original NVD description (English source)
pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined directly under a hoisted node_modules directory. Traversal aliases could escape that directory, while reserved aliases such as .bin or .pnpm could overwrite pnpm-owned layout. This vulnerability is fixed in 10.34.4 and 11.7.0.