CVE-2026-59195: pnpm Path Traversal in Config Dependencies

Technical summary

CVE-2026-59195 is a path traversal vulnerability (CWE-22) in pnpm's handling of the env-lockfile document's configDependencies section within pnpm-lock.yaml. The package manager fails to sanitize or validate package names before using them to construct symlink paths under node_modules/.pnpm-config. An attacker who controls a repository can embed traversal sequences (e.g., ../) in config dependency names. During install, pnpm processes these unsanitized names and creates symlinks at paths influenced by the attacker's input, enabling arbitrary file write access relative to the project root. The vulnerability stems from insufficient input validation at the point where lockfile entries are translated into filesystem operations.

Business impact

Development teams using pnpm are at risk of supply-chain compromise through poisoned lockfiles in shared repositories. An attacker gaining control of a project repository (or a dependency repository with transitive lockfile inclusion) can inject arbitrary files or overwrite existing project files during routine dependency installation. This creates a silent compromise vector—developers may unknowingly execute malicious code injected into build scripts, configuration files, or application code. For organizations managing multiple projects or using monorepos, a single compromised lockfile can affect numerous teams. The impact is heightened in CI/CD pipelines where pnpm install runs automatically and with elevated privileges.

Affected systems

pnpm versions prior to 10.34.4 (in the 10.x branch) and prior to 11.8.0 (in the 11.x branch) are vulnerable. The vulnerability affects any development environment or CI/CD system running an affected version of pnpm, regardless of operating system. Node.js projects of any size that depend on pnpm for package management are in scope. The attack surface is particularly broad because the malicious pnpm-lock.yaml file can be committed to any shared or public repository, affecting all downstream consumers of that code.

Exploitability

Exploitability is rated as HIGH because the vulnerability requires no special privileges to trigger—any developer cloning a compromised repository and running pnpm install will execute the attack. The only prerequisite is user interaction (running the install command), which is routine and expected. An attacker needs only repository write access (or control of a dependency repository) to inject a crafted lockfile. No authentication bypass or complex setup is required, and the attack leaves minimal forensic traces, making detection difficult without careful examination of lockfile changes.

Remediation

Organizations must upgrade pnpm immediately to version 10.34.4 (for the 10.x series) or 11.8.0 (for the 11.x series), where input validation has been added to sanitize config dependency names. Simultaneously, audit all pnpm-lock.yaml files in use for suspicious config dependency entries, particularly those containing path traversal sequences (../, ..\, or similar patterns). Review repository access controls and commit history to identify potentially compromised lockfiles. Consider enabling lockfile signature verification if available, and establish a policy requiring lockfile review before merging to main branches.

Patch guidance

Upgrade pnpm via your package manager of choice (npm, yarn, or manual binary download). For npm global installation: npm install -g pnpm@latest. For projects using a specific pnpm version in .npmrc or packageManager field, update those version constraints to 10.34.4 or later for 10.x users, or 11.8.0 or later for 11.x users. Verify the upgrade by running pnpm --version and confirm the version matches or exceeds the fixed versions. After upgrading, re-run pnpm install to validate that lockfiles parse correctly and no warnings about invalid dependency names appear. Test in a non-production environment first to rule out compatibility issues with project-specific configurations.

Detection guidance

Monitor pnpm-lock.yaml commits for changes to the configDependencies section, particularly additions of entries containing ../, ..\, or other path traversal patterns. Implement pre-commit hooks that reject lockfiles with suspicious config dependency names. In CI/CD, log and alert on pnpm install commands that process lockfiles with unrecognized or anomalous dependency entries. Examine filesystem logs for symlink creation outside expected node_modules/.pnpm-config paths. Use file integrity monitoring on critical project files (package.json, .env, build scripts) to detect unauthorized modifications during or after pnpm operations. For historical detection, search git logs for lockfile changes introducing potential traversal sequences in the configDependencies field.

Why prioritize this

This vulnerability merits immediate remediation despite not yet appearing on the CISA KEV list. The CVSS 8.2 HIGH score reflects the combination of network exploitability, low attack complexity, and high integrity impact. The absence of authentication requirements and the routine nature of pnpm install make this a low-friction attack. For development and CI/CD environments, the ability to silently inject code into projects poses substantial risk to build integrity and downstream software supply. The fix is straightforward (version upgrade) and widely available, making delay indefensible.

Risk score, explained

The CVSS 3.1 score of 8.2 (HIGH) is driven by several factors: Attack Vector (Network) reflects that the malicious lockfile can be distributed remotely; Attack Complexity (Low) means no special conditions or configuration are needed; Privileges Required (None) and User Interaction (Required) together indicate that any user running pnpm install triggers the vulnerability; Scope (Changed) indicates impact extends beyond the vulnerable component to the broader system; Confidentiality (None) and Integrity (High) show that data corruption or code injection is the primary threat; and Availability (Low) acknowledges potential for denial of service through filesystem exhaustion or critical file overwrites. The score reflects a significant but not critical threat that demands swift action in most environments.

Frequently asked questions